Cybersecurity Forensics and Incident Response Analyst

Job Description: Our Security Analysts play a critical role in protecting the organization through activities such as log analysis, incident response, digital forensics, security tooling development, and risk assessment. In this role, you will be expected to perform effectively in high-pressure situations, think from both an attacker and defender perspective, and help drive timely, risk-based decisions across technical and business teams. You should be able to balance technical risk with business priorities and communicate findings, impacts, and mitigation strategies clearly to global stakeholders and leaders at different levels. The ideal candidate brings strong technical depth, practical experience in information security, excellent written and verbal communication skills, a collaborative mindset, and a willingness to continuously learn and apply new skills. Must be able to participate in a rotating on-call schedule and collaborate effectively across geographically distributed teams. Flexibility to work outside normal business hours during critical incidents or emergency situations is essential for success in this role. Must be willing and able to travel occasionally to Stuttgart, Germany, approximately 1-2 weeks annually.

Key Responsibilities: Cyber Forensics and Incident Response Lead and support digital forensics and incident response activities across the full lifecycle, including triage, investigation, containment, eradication, recovery, and post-incident reporting. Perform live-system, offline, and remote compromise investigations; collect, preserve, and analyze forensic artifacts such as memory, disk, endpoint, and network evidence in a forensically sound manner. Analyze malicious activity, attack techniques, and compromise scope across systems and networks to identify root cause, business impact, and required remediation actions. Coordinate response activities across technical and business stakeholders during critical incidents, ensuring clear communication, strong cross-functional alignment, and effective decision-making under pressure. Prepare clear, audience-appropriate updates, reports, and executive summaries, and communicate investigation findings, risks, and recommendations effectively, including in high-pressure situations. Collaborate with SOC, Cyber Threat Intelligence, and other cross-functional teams to improve detection content, workflows, monitoring visibility, and overall response effectiveness. Use and enhance investigative capabilities across SIEM, SOAR, EDR, packet analysis, and forensic toolsets, and recommend improvements to security processes, controls, and response capabilities. Proactively identify emerging threats, hunt for suspicious activity, and help drive preventive and detective improvements across the enterprise environment.

Basic Qualifications: Bachelor's degree in Computer Science, Electrical Engineering, or a closely related field. At least 3 years of hands-on experience in incident response, digital forensics, or a combination of both, excluding certification-only experience. Strong proficiency in Windows environments, including enterprise security controls in Active Directory-based infrastructures. Proficiency in one or more scripting or programming languages such as Python, Bash, or PowerShell to support automation, detection, and investigation activities. Experience conducting malware analysis using static and dynamic techniques, including debuggers, disassemblers, and sandbox environments. Experience using AI-supported security capabilities to accelerate alert triage, investigations, threat hunting, or workflow automation, combined with the ability to validate results critically and apply appropriate human oversight. Ability to produce clear malware analysis reports for operational teams and broader enterprise stakeholders. Experience working in international or globally distributed environments. Strong critical thinking and problem-solving skills. Preferred

Qualifications: Relevant cybersecurity or digital forensics certifications. One or more industry-recognized certifications, such as GIAC, ISC2, EC-Council, Offensive Security, or comparable credentials in incident response, forensics, penetration testing, or cloud security. Experience building internal security tools or utilities that improve the speed, scale, and effectiveness of security operations. Broad and deep technical knowledge across areas such as cryptography, network security, software security, malware analysis, digital forensics, security operations, incident response, and threat intelligence. Experience in security analytics, including intrusion detection, anomaly detection, and the application of data analysis or machine learning techniques to security use cases. Understanding of AI and machine learning concepts relevant to cybersecurity, including anomaly detection, generative AI use cases, prompt-related risks, model limitations, and the secure, responsible use of AI in security operations. Intellectual curiosity and a strong desire to continuously learn and grow in the field. Experience reconstructing malicious attacks or suspicious activity to determine scope, timeline, root cause, and impact. Ability to characterize and analyze network traffic, identify anomalous activity or potential threats, and investigate anomalies using packet data and network metadata. Ability to create forensically sound duplicates of evidence, including disk and triage images. Experience with disk forensics, forensic image creation, memory analysis, and the use of relevant analysis tools. Solid understanding of network topologies and security technologies such as firewalls, IDS/IPS, web proxies, DNS, and web application firewalls. Hands-on experience with forensic and investigative tools and platforms such as EnCase, FTK, SIFT, X-Ways, Volatility, Sleuth Kit/Autopsy, SIEM, SOAR, and EDR solutions. Experience with Windows forensics, including Windows Event Logs and the Registry, as well as creating forensic or triage images using tools such as Velociraptor. Experience with automated compromise assessment, IOC search tools on endpoints, and the interpretation of investigation results. Good understanding of the MITRE ATT&CK framework, adversary tactics, techniques, and procedures, as well as authentication, authorization, and auditing technologies across enterprise environments. Experience working with Splunk or comparable SIEM platforms and hands-on experience with Endpoint Detection and Response (EDR) tools. Experience conducting investigations using a broad range of detective technologies, including packet capture analysis, host forensics, memory analysis, and enterprise monitoring platforms. Experience designing cybersecurity systems and controls within enterprise environments and working knowledge of virtualized environments. Additional language skills, particularly Spanish or Portuguese.

Additional Information: Equal Opportunity Employer, including disability / veterans. Please note that employment is contingent upon the successful completion of a drug screen and background check. Candidates who have been offered the position must pass both screenings before their start date. For more information on our culture and benefits, please visit: Culture and Benefits | Bosch in the USASummary

Type: Full-time

Function: Information Technology