Senior Digital Forensic Investigator

Overview

Cohesity is a leader in AI-powered data security and management. Aided by an extensive ecosystem of partners, Cohesity makes it easy to secure, protect, manage, and get value from data — across the data center, edge, and cloud. Cohesity helps organizations defend against cybersecurity threats with comprehensive data security and management capabilities, including immutable backup snapshots, AI-based threat detection, monitoring for malicious behavior, and rapid recovery ’ve been named a Leader by multiple analyst firms and have been globally recognized for Innovation, Product Strength, and Simplicity in Design.

Join us on our mission to shape the future of our industry.

We are seeking a Senior Digital Forensic Investigator to serve as the operational manager of our Santa Clara Forensic Laboratory. This role combines hands-on forensic expertise with lab management and operational leadership. The successful candidate will oversee all aspects of the lab's forensic acquisition, imaging, and chain-of-custody operations, while independently executing complex investigations and supporting both the Investigations & Forensics team and Security Incident Response Team (SIRT).

This role is based on-site at our Santa Clara facility, with minimum 3 days/week in the lab.

Lab management responsibilities include maintaining forensic equipment, managing evidence intake and processing workflows, ensuring strict adherence to chain-of-custody protocols, administering forensic licensing and compliance standards, training team members on proper evidence handling procedures, and supporting Bay Area field operations. You will exercise strong independent judgment, communicate with precision, and maintain the highest standards of evidentiary integrity — your work directly impacts the defensibility of investigations and litigation outcomes.

• Lead and execute end-to-end digital forensic investigations across endpoint, cloud, email, identity, and SaaS environments.
• Conduct deep-dive analysis for insider threat, data exfiltration, IP theft, fraud, employee misconduct, and ethics matter investigations.
• Support SIRT as the Advanced Forensic Tier on high-severity security incidents — establishing attribution, root cause, and precise forensic timelines.
• Perform forensic imaging and acquisition of endpoints and storage media in accordance with established forensic standards and chain of custody protocols, ensuring evidence integrity from collection through analysis.
• Conduct structured forensic analysis using industry-standard platforms including Magnet AXIOM Cyber, Cellebrite Endpoint Collector, Cellebrite Endpoint Investigator, and Sumuri Recon.
• Collect, preserve, and analyze digital evidence in a forensically sound manner, maintaining chain of custody and evidentiary integrity throughout.
• Produce executive-quality investigation reports suitable for HR proceedings, legal review, litigation support, and regulatory disclosure.

• Manage the Santa Clara Forensic Laboratory as the day-to-day operational lead: oversee evidence intake, storage, processing workflows, and maintain strict adherence to chain-of-custody protocols and forensic standards.
• Maintain forensic hardware, software, and tools (Magnet AXIOM, Cellebrite, Sumuri, write blockers, imaging devices, etc.) to ensure consistent availability and compliance with licensing and certification requirements.
• Train and mentor team members on proper evidence handling, forensic imaging procedures, and chain-of-custody protocols; ensure compliance with internal standards and external legal/regulatory requirements.
• Support field evidence collection operations across the Bay Area, including onsite imaging at corporate facilities and remote locations as needed.

• Execute eDiscovery collections from Exchange/O365, cloud platforms, and endpoints in response to legal holds and regulatory requests.
• Work closely with Legal to scope, collect, and produce electronically stored information (ESI) with defensible methodology.
• Apply custodian-level data scoping, deduplication, and privilege filtering aligned with counsel’s…