Digital Forensics and Incident Response (DFIR) Senior Associate

About the role

Join PwC’s Technology Consulting practice to lead security engagements, improve incident response capabilities, and deliver forensic analysis for large enterprises. You will work closely with clients to assess their cyber‑security posture, uncover evidence of compromise, and guide them toward a more resilient environment.

Key responsibilities

• Manage all aspects of a security engagement from inception to completion.
• Evaluate and enhance the effectiveness of incident response and security policies.
• Analyze client internal policies, processes, and procedures to identify strategic and tactical gaps.
• Recommend actions to mature the client’s incident response program and overall cyber‑security posture.
• Collect, document, and perform structured analysis of forensic data and present findings to business stakeholders.
• Conduct triage and thorough examinations of various digital media within client environments.
• Perform forensic analysis on Windows and Unix systems to uncover evidence of compromise.
• Execute log analysis locally and through SIEM or log‑aggregation tools.
• Hunt threat actors across large enterprise networks and cloud environments.
• Analyze packet captures using tools such as Wireshark or TCPdump.

Required profile

• University degree in Computer Science, Computer Engineering, Information Systems, Electrical/Electronic Engineering or related IT field.
• Minimum 3 years of experience in Cyber Security – Digital Forensics and Incident Response services.
• Hands‑on experience with cloud platforms (AWS, GCP, Azure).
• Proficiency with industry‑standard forensic tools (EnCase, FTK, X‑Ways, Sleuthkit, UFED).
• Experience with Endpoint Detection & Response tools (Cortex, Carbon Black, CrowdStrike).
• Relevant certifications such as GCFA, ENCE, CHFI are a plus.

Required skills

• EnCase
• FTK
• X‑Ways
• Sleuthkit
• UFED
• AWS
• Google Cloud Platform (GCP)
• Microsoft Azure
• Cortex XDR
• Carbon Black
• CrowdStrike
• SIEM/log aggregation tools
• Wireshark / TCPdump
• Windows forensic analysis
• Unix/Linux forensic analysis
• Threat hunting
• Incident response
• Digital media triage