Incident Responder (DFIR)

About the Company

MOXFIVE is focused on eradicating adversaries across clients' entire digital footprints. We provide a faster, nimbler approach to DFIR, covering everything from endpoints to cloud-native workloads and SaaS applications.

Responsibilities

• Perform live response work and forensic analysis to support breaches ranging from ransomware to nation-state threats
• Conduct investigations across Windows, Mac, Linux, and cloud environments (AWS, GCP, Azure)
• Analyze account takeovers and business email compromise (BEC)
• Provide high-quality investigative insights to support client needs

Requirements

• Experience responding to threat activity as an IR consultant or SOC analyst
• Strong understanding of Windows, Mac, and Linux fundamentals
• Proficiency in forensic artifacts, BEC analysis, and network analysis
• Knowledge of or passion for cloud-native investigations (AWS, GCP, Azure)
• Availability for at least a few hours per week to take on IR work

Preferred Qualifications

• Experience with cloud-native forensics
• Deep technical expertise in identifying threat actor activity versus legitimate user behavior