DFIR Associate Manager – Digital Forensics & Incident Response

About the role

Accenture is seeking a DFIR Associate Manager to lead investigations of high‑impact cyber incidents and help clients improve their cyber resilience. You will work with a diverse team of security professionals, applying forensic techniques across endpoints, servers, cloud environments and mobile devices.

Key responsibilities

• Lead and support response efforts during critical cybersecurity incidents, coordinating with security teams, business stakeholders and management.
• Investigate ransomware, malware infections, insider threats, data breaches, BEC, DDoS attacks and advanced persistent threats.
• Conduct detailed forensic investigations to determine scope, impact, root cause and remediation requirements.
• Perform digital forensic analysis of endpoints, servers, cloud platforms and mobile devices using industry‑standard tools.
• Develop and enhance incident response playbooks, procedures and documentation.
• Conduct proactive threat hunting and security investigations to identify hidden adversary activity.
• Mentor junior team members and deliver knowledge‑sharing sessions on incident response and forensic best practices.

Required profile

• Minimum 5 years of experience in Digital Forensics and Incident Response.
• Strong understanding of the Incident Response lifecycle, Digital Forensics methodologies and the MITRE ATT&CK framework.
• Hands‑on experience with Windows and Linux operating systems, networking fundamentals and security concepts.
• Experience with memory, disk and network forensics, as well as static and dynamic malware analysis.

Required skills

• Forensic tools: FTK, Autopsy, Volatility, EnCase, Magnet AXIOM, SIFT, REMnux.
• Security technologies: SIEM, endpoint protection, network security and email security platforms.
• Operating systems: Windows, Linux.
• Scripting/automation: Python, PowerShell.
• Frameworks and methodologies: MITRE ATT&CK, Incident Response lifecycle, Digital Forensics methodologies.
• Additional capabilities: Mobile forensics (Android/iOS), threat intelligence, threat hunting.

What we offer

• Competitive salary package with performance bonus and 13th month pay.
• Health benefits including HMO and life insurance coverage.
• Flexible hybrid working arrangement and possible shift schedules.
• Company‑sponsored training, upskilling and certification sponsorship (e.g., OSCP, GCFA, GCIH).
• Employee Stock Purchase Plan, car and housing assistance, inclusive work culture.