Senior Security Researcher - Digital Forensics Expert

• Hunt and investigate targeted intrusions, long-dwell compromises, and espionage- driven activity across enterprise, cloud, identity, and network environments. 
• Perform advanced forensics across operating systems, cloud, memory, and network telemetry; correlate signals to determine the scope of compromise. 
• Build innovative tooling, research systems, and hunting/investigation workflows; identify capability gaps and propose automations to close them. 
• Produce clear reports, forensic timelines, threat-actor assessments, and actionable detection and remediation guidance. 
• Support internal security, threat intelligence, detection engineering, and investigation teams with expert forensic findings and technical analysis. 
• Partner with the Threat Intelligence team to resolve complex intrusions in customer networks. 
• Represent the organization through conference talks, workshops, and original research. 

• Extensive hands-on APT hunting, intrusion investigation, and digital forensics. 
• Deep understanding of APT tradecraft - stealth, persistence, credential abuse, defense evasion, living-off-the-land, custom tooling, supply-chain compromise, and command-and-control. 
• Broad forensic expertise across operating systems, cloud platforms, network and edge infrastructure, and memory, using industry-standard forensic and hunting tools. 
• Telemetry analysis across security platforms (EDR, SIEM, network, and identity systems) and the ability to build detection and hunting logic. 
• Strong development skills in Python (and ideally another language such as Go, C/C++, or PowerShell) to build tooling, automations, and analysis pipelines. 
• Strong communication for technical and executive audiences, including conference-grade presentations. 
• Represents the organization publicly, delivering talks, workshops, and research at top-tier cybersecurity and forensics conferences. 

  Nice to Have

• Malware analysis and reverse engineering. 
• Experience with enterprise EDR/XDR and SIEM platforms. 
• Container, SaaS, and hybrid-cloud investigation experience. 
• Threat-intel collaboration; published research or prior conference talks.