Security Engineer (DFIR Lab)

About the role

The Security Engineer will own the DFIR Lab’s infrastructure, ensuring that hardware, software and processes are reliable, secure and well‑documented. You will work closely with incident response teams to provide a robust environment for forensic investigations and threat analysis.

Key responsibilities

• Maintain and monitor the lab’s servers, workstations, storage and networking devices.
• Keep the asset inventory up to date and support license renewals, purchases and budgeting.
• Deploy, configure and optimise forensic tools such as EnCase, Magnet Axiom, FTK, Cellebrite, THOR, Velociraptor, KAPE and IDA Pro.
• Implement access controls, logging, audit trails and monitoring to protect lab data integrity.
• Evaluate new technologies and contribute recommendations to expand lab capabilities.
• Develop scripts and automation to streamline forensic workflows.
• Document SOPs, lab configurations and tool usage guidelines.
• Collaborate with customers to provision hardware and software for assessments and incident response engagements.

Required profile

• At least 5 years of experience in digital forensics and incident response environments.
• Strong understanding of evidence management, data acquisition and forensic hardware (write blockers, specialised cables, adapters).
• Proficiency with Linux, Windows and networking devices.
• Ability to work independently and maintain high standards of security and privacy.

Required skills

• Magnet Axiom
• IDA Pro
• Cellebrite
• Velociraptor
• KAPE
• Security Onion
• FTK Imager
• EDR
• Cloud‑based environments
• NDR
• THOR
• Unix
• Networking Devices
• Windows
• Vmware ESXi
• Mac
• Linux
• EnCase
• Nutanix