Principal, Digital Forensics Investigator

Description

Ingram Micro is the business behind the world’s brands, providing more ways to realize the promise of technology®. We are an integral part of the technology ecosystem, helping our partners grow and thrive through the creation and delivery of Information Technology, Cloud solutions and Lifecycle services. With more than $54 billion in revenue and the ability to reach 90% of the global population, we are one of the world’s largest technology distributors, serving our partners through operations in 61 countries with 29,000 associates.Ingram Micro is the business behind the world’s brands, providing more ways to realize the promise of technology®. We are an integral part of the technology ecosystem, helping our partners grow and thrive through the creation and delivery of Information Technology, Cloud solutions and Lifecycle services. With more than $54 billion in revenue and the ability to reach 90% of the global population, we are one of the world’s largest technology distributors, serving our partners through operations in 61 countries with 29,000 associates.
Ingram Micro has earned Great Place to Work Certification™ for 2022-2023 in the United States! This prestigious recognition reflects our commitment to our people and our culture. 
Come join our team where you’ll make technology happen in surprising ways. Let’s shape tomorrow - it’ll be a fun journey! 

Position Summary 

We are looking for a Principal Digital Forensics Investigator.  The Principal Digital Investigator will work within the Security Incident Response Team (SIRT) to assess, analyze and respond to serious information security events and incidents in a global company.  This position requires relevant digital forensic certifications such as the EnCase Certified Examiner (EnCE), Magnet Axiom Certified Forensic Examiner, Cellebrite Certified Mobile Examiner, and others.  The position also requires significant experience in securing physical and digital evidence and performing forensic examinations.  This position will work with other information security teams as well as Information Systems teams to stop security events in progress, investigate all aspects of an event, and produce written reports. 

Key Responsibilities 

•                    Perform forensics on network, host, memory, and other artifacts originating from multiple operating systems, applications, or networks and extract IOCs (Indicators of Compromise) and TTP (Tactics, Techniques, and Procedures). 
•                    Investigate incidents leveraging forensics tools including Encase, FTK, X-Ways, Axiom, SIFT, and Splunk to determine source of compromises and malicious activity that occurred. 
•                    Collect, analyze, assess, and disseminate information about cyber threats and potential attacks. 

•                    Conduct human-driven, proactive, and iterative hunts through enterprise networks, endpoints, or datasets to detect malicious, suspicious, or risky activities that have evaded detection by existing tools. 
•                    Participate with Security Incident Response Team (SIRT) in responding to active and time-sensitive threats including communications and coordination across different teams. 
•                    Maintaining proper chain of custody of evidence and associated documentation 
•                    Testifying in court, Grand Jury, or other legal proceedings through testimony, sworn affidavits, or other legal instruments. 

Skills & Experience 

•                    3+ years of strong hands-on experience in digital forensics examinations and/or investigations using the EnCase tool.  
•                    3+ years of experience in law enforcement (deputized) investigations (fraud, counterintelligence, high-tech crimes, etc.). 
•                    3+ years of experience in interviewing after taking a Reid Technique class (or an equivalent) 

•                    Advanced knowledge and understanding in various disciplines such as security engineering, system and network security, authentication and security protocols, cryptography, and application security.  
•                    Experience with cloud services. 
•                    Strong understanding of vulnerabilities, common attack vectors and has attacker mindset: ability to think about creative threats and attack vectors.  
•                    Strong communication (i.e., written and verbal), presentation, teamwork skills and resourcefulness.  
•                    Deep understanding of internals and constructs of modern operating systems. 

•                    Experienced with EnCase, FTK, X-Ways, Axiom, SIFT, Splunk, Elastic Stack, Redline, Volatility, WireShark, TCPDump, and open source forensic tools. 
•                    Relevant security certifications (EnCE, MCFE, CFCE, CCME, CCO, CCPA, GNFA, GCFA). 

Job Qualifications and Educational Requirements 

•Bachelor’s degree from an accredited University or equivalent work experience 

•Work Experience: 10+ years; 5+ directly related to role 

•Provide three current work references & pass a criminal background check 

•Pass a proficiency exam related to the role 

This is not a complete listing of the job duties.  It’s a representation of the things you will be doing, and you may not perform all these duties.This is not a complete listing of the job duties.  It’s a representation of the things you will be doing, and you may not perform all these duties.

The typical base pay range for this role across the U.S. is USD $102,100 - $137,800- $173,600 per year.

Please be prepared to pass a drug test and successfully pass a pre-employment (post offer) background check that includes verification of vaccination status.

Ingram Micro requires all new associates to be fully vaccinated against COVID-19. Therefore, this position requires applicants to submit proof, prior to start date, that the successful applicant is fully vaccinated against COVID-19. Ingram Micro will comply with applicable laws regarding the reasonable accommodation of individuals with disabilities and/or sincerely held religious beliefs.  Applicants will be notified of the requirements of Ingram Micro’s COVID-19 policy and process for verification of vaccination status prior to the start of employment. 

Ingram Micro believes there is no place in our society for social injustice, discrimination or racism. As a company we do not – and will not – tolerate these actions. Ingram Micro Inc. is committed to creating a diverse environment and is proud to be an equal opportunity employer.  All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other protected category under applicable law.  

 
#LI-RT1
#LI-Hybrid