Digital Forensics Analyst Job Santa Clara area,California USA,IT/Tech

7+ years of progressive experience in digital forensics, cybersecurity investigations, or a closely related discipline.
Demonstrated expertise conducting insider threat, data exfiltration, and employee misconduct investigations in enterprise environments.
Proficiency with enterprise forensic platforms:
Magnet AXIOM Cyber, Cellebrite Endpoint Collector and Endpoint Investigator, and Sumuri Recon or comparable tooling.
Strong working knowledge of forensic imaging standards and acquisition methodologies — including write-blocking, hash verification, and documented chain of custody — consistent with industry frameworks such as ACPO, SWGDE, or equivalent.
Hands-on proficiency with EDR platforms — particularly Crowd Strike Falcon — for behavioral analysis, process telemetry, and forensic artifact review.
Strong working knowledge of Microsoft 365 forensics:
Exchange Online mail flow and Recoverable Items, Azure AD sign-in and audit logs, Purview Compliance, and MDE.
Working knowledge of cloud and SaaS forensic investigation: OAuth and SAML authentication flows, conditional access logs, cloud storage access patterns, and admin audit trails.
Familiarity with network-layer investigation fundamentals: DNS, proxy, VPN, and firewall log analysis sufficient to reconstruct data movement and access patterns.
Proficiency in Google Sec Ops/Chronicle (YARA-L) for investigation and threat hunting.
Experience using device management platforms (JAMF, Intune, SCCM) for custodian device attribution and asset profiling in the context of investigations.
Proven ability to produce legally defensible, executive-quality investigation reports with precise evidentiary grounding.
Experience supporting eDiscovery processes, including ESI collection, legal hold execution, and custodian data scoping.
AI Capability Building — Required
This team actively develops AI-augmented investigative workflows. The ability to build with AI tools is a core requirement, not a nice-to-have.
Demonstrated hands-on experience using large language model (LLM) platforms — such as Anthropic Claude or Microsoft Copilot — to augment investigative, analytical, or reporting workflows.
Ability to design and implement structured prompting frameworks, analysis pipelines, or automation logic that apply AI to forensic use cases such as timeline synthesis, log triage, anomaly narration, or report generation.
Comfort evaluating AI-generated output critically — understanding where LLM reasoning aids investigation and where human judgment must govern evidentiary conclusions.
Experience or strong aptitude for building lightweight investigative tooling using Python, Power Shell, or similar, with AI as a reasoning or enrichment layer.

#J-18808-Ljbffr