About the position

As a Digital Forensics & Incident Response (DFIR) Specialist, you will play a key role in investigating cybersecurity incidents, performing digital forensic analysis, and supporting the containment and remediation of security threats across SITA's global environment. You will work closely with Security Operations, CSIRT Threat, Cloud & Infrastructure, Product Security, and Corporate IT teams to respond to threats, preserve evidence, and determine the root cause and impact of security incidents. As part of SITA's Enterprise Information Security Office (EISO) and CSIRT Response Team, you will help strengthen the organization's incident response capabilities, forensic readiness, and cyber resilience while supporting the protection of SITA, its customers, and the broader air transport ecosystem. This role is ideal for a proactive hands-on security professional with strong investigation and analytical skills who is passionate about incident response, digital forensics, and continuous improvement.

Responsibilities

• Investigate and manage cybersecurity incidents throughout the full incident response lifecycle, from analysis and containment to recovery and post-incident review.
• Collaborate with SOC, CSIRT, IT, Cloud, Infrastructure, and Engineering teams to coordinate effective incident response activities and drive remediation efforts.
• Produce incident reports and technical findings while continuously enhancing response processes, playbooks, and operational procedures.
• Conduct digital forensic investigations across endpoints, servers, cloud, network, and SaaS environments, including evidence collection, preservation, analysis, and reporting.
• Analyze forensic artifacts to identify attacker activity, determine root causes, assess business impact, and support investigations into malware, ransomware, account compromise, and data breaches.
• Maintain robust evidence handling and documentation practices in alignment with legal, regulatory, and industry standards.
• Support investigations involving insider threats, policy violations, privileged access misuse, and potential data loss incidents, while providing technical evidence and findings to Legal, Compliance, HR, and other stakeholders.
• Identify and recommend security control improvements to mitigate insider threat risks and strengthen the organization's overall security posture.
• Develop and maintain automation, scripts, and tools to enhance evidence collection, analysis, and incident response workflows.
• Leverage AI-driven capabilities, security analytics, and telemetry to improve investigative efficiency and response effectiveness.
• Enhance DFIR capabilities by improving logging, forensic readiness, tooling, and operational processes across enterprise environments.

Requirements

• Proven experience in digital forensics, incident response, and cyber investigations within large enterprise environments.
• Hands-on expertise with EDR/XDR platforms, SIEM solutions, forensic tools, and security monitoring technologies.
• Strong ability to investigate and analyze security incidents across endpoints, servers, cloud environments, networks, and identity platforms.
• Proficiency in Python and/or PowerShell, with working knowledge of KQL and other security-focused query languages.
• Solid understanding of cyber threat actor tactics, techniques, and procedures (TTPs), including the MITRE ATT&CK framework.
• Excellent analytical, problem-solving, and communication skills, with the ability to clearly document and present technical findings to diverse stakeholders.

Nice-to-haves

• Professional certifications such as GCFA, GNFA, GCIH, GREM, GCFE, CISSP, OSCP, or equivalent DFIR and cybersecurity credentials.
• Hands-on experience in cloud security investigations and DFIR activities across Azure, AWS, and/or Google Cloud Platform (GCP) environments.
• Strong proficiency with digital forensic methodologies and tools, including FTK, EnCase, Velociraptor, KAPE, Autopsy, Volatility, or similar platforms.
• Experience in aviation, transportation, critical infrastructure, or operational technology (OT) environments, with knowledge of security automation, orchestration, and AI-assisted investigation techniques to enhance incident response effectiveness.

Benefits

• Work from home up to 2 days/week
• Make your workday suit your life and plans
• Take up to 30 days a year to work from any location in the world
• Access our 24/7 EAP and Champion Health platform for all-around wellbeing
• Build your skills with LinkedIn Learning and internal training programs
• Competitive Benefits: Designed to suit your country and contract type