[Hiring] Incident Response Engineer @American Cyber

Role Description

American Cyber is seeking a detail-oriented Incident Response Engineer / Digital Forensics Analyst (Independent Contractor – 1099) to support cybersecurity investigations and incident response efforts. In this contract role, you will conduct forensic analysis, preserve digital evidence, and deliver clear, defensible findings that support security, legal, and compliance needs. You will work closely with incident response, SOC, and threat intelligence stakeholders to investigate incidents, identify root causes, and improve investigative readiness.

Location

• Remote (U.S.-based preferred)
• United States

What You’ll Do

• Conduct forensic analysis of digital evidence across endpoints, servers, network traffic, mobile devices, and cloud environments
• Collect, preserve, and document evidence using industry best practices and legal standards, maintaining proper chain of custody
• Support incident response by performing root cause analysis, identifying Indicators of Compromise (IOCs), and mapping adversary TTPs
• Analyze logs, malware samples, memory artifacts, and network data to reconstruct timelines and attacker activity
• Produce clear, detailed, and defensible forensic reports for technical, executive, and legal audiences
• Provide expert support for internal investigations and litigation readiness; participate in testimony or proceedings when required
• Collaborate with SOC, threat intelligence, and vulnerability management teams to strengthen detection, response, and prevention capabilities
• Stay current on emerging threats, forensic methodologies, and tooling; recommend improvements to investigative workflows
• Contribute to the development and continuous improvement of forensic processes, procedures, documentation, and incident response playbooks
• Support security awareness and readiness initiatives by translating lessons learned into actionable guidance

Qualifications

• Bachelor’s degree in Computer Science, Information Security, Digital Forensics, or a related field (or equivalent practical experience)
• 2–5 years of experience in digital forensics, incident response, or cybersecurity investigations
• Strong understanding of Windows, Linux, and macOS operating systems; file systems; and common network protocols
• Hands-on experience with forensic tools such as EnCase, FTK, X-Ways, Cellebrite, Magnet AXIOM, Volatility, or similar platforms
• Familiarity with SIEM platforms, intrusion detection systems, and endpoint detection and response (EDR) solutions
• Working knowledge of evidence handling procedures, chain of custody requirements, and relevant legal/compliance considerations
• Strong analytical and problem-solving skills with high attention to detail
• Excellent written and verbal communication skills, including the ability to present findings to diverse audiences

Preferred Qualifications

• Industry certifications such as GCFA, GCFE, CHFI, EnCE, CFCE, or CCE
• Experience supporting litigation, law enforcement investigations, or regulatory compliance matters
• Familiarity with scripting/automation (Python, PowerShell, Bash) to streamline forensic tasks
• Experience with cloud and SaaS investigations (AWS, Azure, Google Cloud, and common SaaS platforms)
• Knowledge of the MITRE ATT&CK framework and common threat actor tactics and techniques

Engagement Terms (1099 Contractor)

• This role is structured as an independent contractor (1099) engagement and does not constitute an employment relationship
• You retain discretion over the manner and means of performing services, consistent with agreed deliverables, timelines, and performance expectations
• Compensation structure (hourly and/or project-based) will be defined in a separate agreement
• Contractor is responsible for applicable taxes, insurance, and business expenses unless otherwise specified

Performance Expectations

• Timely, accurate forensic analysis that supports incident response and investigative objectives
• Proper handling, documentation, and preservation of evidence in accordance with legal standards and chain of custody requirements
• Delivery of clear, defensible reporting suitable for technical, executive, and legal stakeholders
• Effective collaboration with internal security and response teams in a distributed environment
• Continuous improvement of forensic processes, investigative readiness, and incident response capabilities