DFIR , Forensics , SOC, VAPT

2. Forensic Investigation & Digital Forensics

Collect, preserve, and analyze digital evidence in a forensically sound manner, ensuring chain of custody.

Conduct forensic investigations of compromised endpoints, servers, cloud systems, email, and mobile devices.

Use forensic tools (e.g., EnCase, FTK, X-Ways, Autopsy, Sleuth Kit, Volatility, Velociraptor) to analyze disk, memory, registry, browser artifacts, system logs, and deleted files, for all digital assets.

Support internal investigations involving fraud, data leakage, IP theft, or employee misconduct.

Work with multiple compliance departments to produce evidence reports and contribute to eDiscovery when required.

3. Threat Analysis

Perform static and dynamic malware analysis and reverse engineering.

Develop Indicators of Compromise (IOCs), analyze TTPs using MITRE ATT&CK framework.

Collaborate with threat intelligence teams to enrich investigations with contextual insights.

4. Post-Incident Review & Process Improvement

Create detailed incident and investigation reports for technical and executive audiences.

Recommend preventive controls, detection improvements, and SOC playbook updates.

Maintain forensic investigation procedures aligned with legal, compliance, and regulatory needs.