Cybersecurity Incident Responder or Senior Incident Responder

Company Description Asceris brings together expertise in cyber incident response, forensic investigations, automation, data science, and cyber insurance to help organizations navigate complex cyber events. The company focuses on improving the customer experience while minimizing the financial and operational impact of cyber incidents. Asceris works closely with insured organizations and partners to deliver rapid, data-driven response and recovery services. Team members are part of a growing, specialized firm that stays at the forefront of cybersecurity, insurance, and incident response industry developments.

Role DescriptionWe are looking to hire an entrepreneurial, well-rounded, and experienced cyber incident handler to join our growing team. Asceris is focused on providing a high level of value and customer service to insured and law firm clients. Key to this is hiring the right people and empowering them. We have developed proprietary software to enable faster and more accurate investigations of business email compromises as well as ransomware attacks. Asceris offers a friendly and entrepreneurial start-up culture, with a focus on accelerating the professional and technical development of our team.

Key Responsibilities

• Work as part of the incident response team to handle ransomware, business email compromise (BEC), and other cybersecurity incidents, taking ownership of assigned investigations and activities
• Collect and preserve source data in response to incidents and conduct detailed analysis of threat actor activity and behaviour
• Prepare clear reports on investigation findings and communicate findings and recommendations to clients and their advisors through follow-up briefings
• Deliver a high level of customer service to law firms, insurers, and their clients throughout incident response engagements
• Contribute ideas and recommendations to continuously improve our services, investigative processes, and proprietary software
• For ransomware incidents, work with specialist partners to support the resolution of cyber extortion incidents, including supporting threat actor engagement where appropriate

Required qualifications

• 2+ years of professional experience in cyber investigations, incident response, digital forensics, or a related field
• Experience investigating ransomware, business email compromise, and other incidents
• Ability to manage multiple projects and competing priorities
• Experience working in consulting or professional services
• Extensive experience working with digital forensics tools
• Experience with host-based Windows forensics
• Experience of recovering / decrypting client data as part of ransomware response
• Strong verbal and written English communication skills
• Experience presenting report findings and recommendations
• Knowledge of current data collection, storage, and chain of custody best practices

Preferred qualifications

• Experience with Unix/Linux and macOS, with an understanding of Active Directory, firewalls, network layers, and protocols
• Experience working with or for law firms
• Experience with KQL
• Experience with Eric Zimmerman forensic tools
• Experience with Python scripting
• Experience with PowerShell scripting
• Experience with EDR solutions, such as SentinelOne, CrowdStrike, or Carbon Black
• Experience with log analysis tools or platforms, such as Splunk or Elastic Stack
• Experience with live memory analysis
• Experience with Azure virtual machines and storage
• Experience with malware sandboxing
• Experience with malware reverse engineering
• Professional proficiency in an additional language, particularly German, Spanish, French, or other European languages, would be advantageous.

Applicable certifications (preferred not required)

• Industry certifications such as GCIA, GCIH, GCFA, GCFE, GCIL, GREM, ENCE, CCIM, CREST, CHFI, OSCP, or similar are a plus.