Reinsurance Group of America, Incorporated
Digital Forensics and Incident Response (DFIR) analyst
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
About the Role
We are seeking a senior incident response ("DFIR") professional to lead complex cyber investigations, strengthen RGA's enterprise resilience, and guide security teams through critical incidents. This role combines hands-on DFIR expertise, strategic advisory capabilities, stakeholder engagement, and security program leadership across global environments.
Who Thrives in This Role?
You are motivated by investigating sophisticated attacks, improving security operations, and turning lessons learned into measurable improvements. You want to leverage the latest tools and methods to "find evil". Always want to help improve tools with new ideas. You are comfortable with engaging executives, legal teams, technology leaders, and technical responders during high-pressure situations.
Key Responsibilities
- Lead enterprise incident response and cyber crisis engagements from detection through recovery.
- Direct host, network, cloud, identity, and SaaS investigations across Windows, Linux, macOS, Microsoft 365, AWS, Azure, and hybrid environments.
- Perform advanced threat hunting and compromise assessments using SIEM, EDR, forensic, and threat intelligence platforms.
- Develop containment, eradication, and remediation strategies aligned to business risk.
- Produce executive briefings, technical reports, board-ready updates, and post-incident reviews.
- Partner with legal, compliance, privacy, audit, and external stakeholders when required.
- Drive adoption of AI-assisted workflows to improve investigation speed, reporting quality, and operational efficiency.
- Support the 24/7 on-call rotation.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Required Experience and Expertise
- 5+ years in incident response, DFIR, security operations, consulting, or related cybersecurity disciplines.
- Experience leading major cyber incidents involving ransomware, business email compromise, insider threats, cloud compromise, supply chain attacks, or advanced persistent threats.
- Strong digital forensics capability using industry-standard forensic and triage tools.
- Experience with Splunk, Microsoft Defender, CrowdStrike Falcon, ServiceNow SIR, and cloud security technologies.
- Knowledge of network protocols, detection engineering, log analytics, and threat hunting methodologies.
- Excellent verbal and written communication skills for technical and executive audiences.
- Demonstrated ability to manage multiple priorities in a global enterprise environment.
- Forensic tools (FTK, Encase, X-Ways, Magnet Axiom, SIFT or other) experience is mandatory.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Leadership Expectations
Provide technical leadership during investigations, influence strategic security decisions, contribute to capability development, and serve as a trusted advisor for cybersecurity risk management and response readiness.
Education and Certifications
Industry certifications such as GCFA, GCFE, GCIH, GCIA, CISSP, CISM, Azure Security Engineer, AWS Security Specialty, or comparable credentials are highly desirable (not mandatory) Bachelor's degree in Cybersecurity, Computer Science, Information Security, Engineering, Intelligence Studies, or a related discipline, or equivalent experience is desirable (not mandatory)
Work Environment
Remote or hybrid eligible. Participation in an on-call rotation. Travel is not required as part of the standard day-to-day duties. The role supports global operations and may engage with stakeholders across multiple regions and time zones.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location