Security Engineer - DFIR Lab

Overview

Lead the management and upkeep of the Digital Forensics and Incident Response (DFIR) Lab's infrastructure, including hardware, software, processes, and documentation to enable effective team operations.

Key Responsibilities

• Maintain and oversee the DFIR Lab’s hardware and software platforms to ensure high availability and performance supporting team activities.
• Update and manage asset inventory, contribute to license renewals, procurement decisions, and budget planning.
• Deploy, configure, and maintain forensic and incident response technologies such as EnCase, Magnet Axiom, FTK, Cellebrite, THOR, Velociraptor, KAPE, IDA Pro, and similar tools.
• Configure and optimize forensic workstations, war laptops, servers, and storage units for operational efficiency.
• Ensure compliance with security, privacy, and data integrity standards within the lab environment.
• Implement access control policies, logging mechanisms, audit trails, and monitoring solutions to safeguard lab operations.
• Assess and recommend new forensic tools and technologies to advance lab capabilities.
• Develop automation scripts and tools to simplify workflows and enhance operational efficiency.
• Document lab processes, configuration details, and tool usage as well as develop and update Standard Operating Procedures (SOPs).
• Collaborate with customers to deploy hardware and software for security assessments and incident responses.
• Support cyber incident response activities through execution of lab-related tasks.

Required Knowledge and Skills

• Proficiency with a broad range of digital forensics and incident response tools including Cellebrite, THOR, Velociraptor, KAPE, IDA Pro, Security Onion, FTK Imager, Magnet Axiom, EnCase.
• Strong understanding of deployment and functionality of incident response technologies such as EDR, NDR, forensic artifact collection, intrusion detection, security monitoring, and log management.
• Hands-on experience with digital forensics hardware such as write blockers, specialized cabling, forensic workstations, laptops, adapters, and connectors.
• Familiarity with evidence management and data acquisition techniques supporting forensic and incident response work in a lab context.
• Solid knowledge of Linux file system structure, command-line tools, and utilities.
• Experience working with network devices including switches, routers, and firewalls.
• Understanding of storage technologies such as NAS devices.
• Proficiency with virtualization platforms, especially VMware ESXi; knowledge of Nutanix or other virtualization software is advantageous.
• Ability to build baseline system configurations for both servers and workstations.
• Experience with Windows, Linux/Unix, and Mac operating systems at both server and desktop levels.
• Experience managing cloud-based environments.

Qualifications and Experience

• Preferred certifications in at least one relevant field such as Incident Response, Digital Forensics, Cloud Computing, Linux/Windows Administration, Penetration Testing, or Security Engineering (e.g., CCE, CHFI, GCFE, INE Security, Microsoft/Azure/VMware/RedHat certifications).
• A minimum of 5 years experience working in technical labs, data centers, DFIR teams, or Systems Engineering roles with practical skills in setting up scalable technical environments.
• Educational qualification such as a Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or Engineering is desired but not mandatory.