SOC forensics - On site

Role & responsibilities

• Knowledge of investigative implications of hardware, Operating Systems, and network technologies.
• Knowledge of data carving tools and techniques (e.g., Foremost).
• Knowledge of anti-forensics tactics, techniques, and procedures.
• Knowledge of concepts and practices of processing digital forensic data.
• Skill in preserving evidence integrity according to standard operating procedures or national standards.
• Skill in using forensic tool suites (e.g., EnCase, Sleuthkit, FTK).
• Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).
• Skill in analyzing anomalous code as malicious or benign.
• Skill in analyzing volatile data.
• Skill in processing digital evidence, to include protecting and making legally sound copies of evidence.
• Ability to conduct forensic analyses in and for both Windows and Unix/Linux environments.
• Skill in identifying obfuscation techniques.
• Skill in interpreting results of debugger to ascertain tactics, techniques, and procedures.
• Skill in conducting bit-level analysis.
• Skill in analyzing memory dumps to extract information.
• Knowledge of reverse engineering concepts.
• Knowledge of malware analysis tools (e.g., Oily Debug, Ida Pro).
• Knowledge of binary analysis.
• Skill in deep analysis of captured malicious code (e.g., malware forensics).
• Skill in using binary analysis tools (e.g., Hexedit, command code xxd, hexdump).
• Skill in analyzing malware.