Digital Forensics & Incident Response Specialist

About the Role

Accenture Security's Digital Forensics & Incident Response (DFIR) team helps organizations understand and contain cyber threats, determine what happened, and recover with confidence. This role involves being part of a specialized DFIR team responding to cybersecurity incidents and conducting forensic investigations for clients across industries.

Key Responsibilities

• Supporting the collection, preservation, processing, and analysis of digital evidence from endpoints, servers, and other relevant sources, following established procedures and maintaining accurate documentation.
• Assisting with investigations of ransomware, business email compromise, unauthorized access, and other cybersecurity incidents by examining evidence and identifying relevant activity.
• Using approved forensic tools, endpoint telemetry, and security logs to conduct assigned analysis and contribute to threat hunting and incident response activities.
• Completing assigned investigative tasks with some guidance, maintaining clear work notes, meeting delivery expectations, and promptly raising questions, risks, or unexpected findings.
• Preparing accurate investigative notes, evidence summaries, technical findings, and draft report content for review by senior team members.
• Participating in client discussions and internal team updates, communicating technical information professionally, and supporting senior investigators in presenting findings.
• Supporting practice operations, including evidence-handling systems, investigative tools, documentation, training, and improvements to established DFIR processes.

Travel may be required for this role.

Requirements & Tech Stack

• Minimum of 2 years of relevant experience in digital forensics, incident response, cybersecurity investigations, or closely related technical work.
• Minimum of 2 years of foundational experience collecting, preserving, and analyzing digital evidence using established investigative procedures.
• Minimum of 2 years working knowledge of cybersecurity incidents, common attacker techniques, operating systems, and security logs.
• Minimum of 2 years of experience using or supporting forensic, endpoint detection and response, or security analysis tools.
• Bachelor's degree or equivalent (minimum 12 years) work experience.

If Associate’s Degree, must have minimum 6 years work experience.

Qualifications (Bonus Points)

• Ability to document technical analysis and communicate findings accurately in writing and verbally.
• Ability to deliver assigned tasks with some guidance, manage priorities, and collaborate effectively in a client-service environment.
• One recognized DFIR certification, such as GCFE, GCIH, GCFA, or equivalent, or active progress toward an equivalent certification.
• Exposure to cloud or identity investigations involving Microsoft 365, Microsoft Entra ID, Azure, or AWS.
• Familiarity with threat hunting, malware triage, memory analysis, or network forensic concepts.
• Participation in ransomware, phishing, business email compromise, or unauthorized-access investigations.
• Experience preparing evidence logs, chain-of-custody records, or other defensible investigative documentation.
• Prior experience in a cybersecurity consulting, security operations, IT support, or incident response team.