Title:  Digital Forensics & Incident Response Specialist

Do you want to join one of the largest professional services organizations in the market? 

Then Deloitte is the place for you. Here, you will have the opportunity to boost your career and strengthen your skills within our technology ecosystem.

We are an international Tech Hub and we are looking for the best Infrastructure Engineers to join our centres of excellence and our community. At Deloitte, you will transform the world as we know it and develop unique and innovative solutions across a wide range of complex transformation projects, taking talent from Portugal to the world. We are strengthening our team and looking for experienced professionals who enjoy and have a natural aptitude for working collaboratively and in a multi-project environment. You can explore all the roles you may perform according to your profile and take the next step in your career!

Will you join us? We are waiting for you. 

Your day-to-day responsibilities: 

• Lead and support the end-to-end cybersecurity incident response process, from initial triage through containment, eradication, recovery, and lessons learned.
• Perform forensic acquisition and analysis of endpoints, servers, cloud environments, email platforms, and network evidence.
• Investigate ransomware, Business Email Compromise (BEC), account compromise, insider threats, data exfiltration, and Advanced Persistent Threats (APTs).
• Collect, preserve, and document digital evidence in accordance with chain-of-custody and forensic integrity requirements.
• Analyze Windows, Linux, and macOS artifacts, including event logs, registry data, file systems, memory, browser activity, and persistence mechanisms.
• Investigate activity within Microsoft 365 and Entra ID, including sign-ins, mailbox audit events, OAuth applications, email rules, and identity compromise.
• Perform timeline analysis to reconstruct attacker activity and identify initial access, lateral movement, persistence mechanisms, and incident impact.
• Analyze memory captures, disk images, suspicious files, scripts, malware behavior, and network traffic.
• Develop and execute investigation queries using SIEM, EDR, and XDR platforms.
• Coordinate containment and remediation actions with SOC, IT, Cloud, Legal, and Privacy teams, as well as business stakeholders.
• Participate in emergency on-site DFIR engagements, traveling to customer or company locations to support urgent incident containment, evidence acquisition, and forensic investigation.
• Participate in an on-call rotation and remain available to respond to critical cybersecurity incidents outside standard business hours, including nights, weekends, and public holidays when required.
• Travel domestically and internationally at short notice to support high-severity incidents and time-critical forensic activities.
• Produce clear incident reports, forensic findings, executive summaries, and remediation recommendations.
• Contribute to the development of Incident Response playbooks, tabletop exercises, and continuous improvement initiatives.

Are you the one we are looking for?

• 6+ years of experience in Digital Forensics, Incident Response, SOC, Threat Hunting, or a related cybersecurity role.
• Strong knowledge of Incident Response methodologies and Digital Forensics processes.
• Hands-on experience investigating security incidents involving endpoints, identities, email, networks, and cloud environments.
• Proven experience responding to high-severity DFIR situations, including emergency incident activation, rapid triage, containment coordination, and evidence preservation under pressure.
• Previous experience participating in on-site incident response engagements and working directly with customers, technical teams, legal teams, and executive stakeholders during active incidents.
• Availability to participate in an on-call rotation and travel at short notice, including internationally, when required to support an active incident.
• Experience with forensic acquisition, evidence preservation, and chain-of-custody procedures.
• Practical knowledge of attacker tactics and techniques mapped to MITRE ATT&CK.
• Ability to correlate evidence across multiple data sources and build robust, defensible incident timelines.
• Strong analytical, investigative, documentation, and communication skills.
• Ability to remain effective during high-pressure and time-sensitive incidents.

Technical & Management Knowledge

Experience with some of the following technologies and investigation areas:

• Digital Forensics & Analysis: EnCase / FTK; Magnet AXIOM; Autopsy / Sleuth Kit; Volatility; KAPE / Velociraptor.
• Incident Response: Microsoft Defender XDR; CrowdStrike Falcon; Microsoft Sentinel; Splunk; Wireshark.
• Platforms & Methods: Windows / Linux / macOS; Microsoft 365 / Entra ID; Azure / AWS; MITRE ATT&CK; NIST / SANS IR.

Nice to Have

• Experience working in MSSP/MDR, consulting, or multi-customer environments.
• Experience investigating ransomware, BEC, identity compromise, and cloud security incidents.
• Skills in malware triage, memory forensics, and network forensics.
• Knowledge of Python, PowerShell, or other scripting languages for forensic automation.
• Experience supporting legal, regulatory, cyber insurance, or law enforcement processes.
• Relevant certifications such as GIAC GCFA, GCIH, GCFE, GNFA, EnCE, CFCE, Microsoft SC-200, or CrowdStrike certifications.

Build a career that fits you

• In a diverse working environment that fosters continuous development and learning;
• Through a personalised career development plan (skills, technical and functional opportunities) tailored to your stage, needs and goals;
• By participating in national and international projects with significant scale and impact in this area of expertise;
• Unlimited access to the world's leading online learning platforms (LinkedIn Learning and Udemy);
• Opportunities for training and certification in the latest technologies, particularly Cloud technologies.

Live a culture of unity

• A culture of innovation and excellence that makes us leaders and trendsetters;
• A friendly environment built on respect, trust, transparency and informality;
• A network for life that connects you with leading experts and knowledge;
• An opportunity to join our communities (Tech, innovation, sports and other interests) and actively participate in social responsibility projects.

About Deloitte 

At Deloitte, you will never work alone. You will have the opportunity to take part in a variety of transformation projects and be part of a team that inspires and supports you in developing differentiated solutions within a dynamic and collaborative environment, where you can perform at your best while benefiting from our wellbeing and flexibility initiatives. We are more than 5,500 people in Portugal, of whom over 2,600 work in technology areas, across offices and Digital Studios in Lisbon, Porto, Braga, Viseu, Coimbra and Faro, as well as technology hubs in Braga. Furthermore, our teams in Portugal have an international reach, demonstrating our strong global leadership in low-code/no-code solutions, telecommunications network engineering, organisational transformation platforms (ServiceNow and Apptio) and the financial services industry (Finastra, TIA and Guidewire).

If you are interested in exploring and developing your skills in any of these technology areas – software engineering, cloud, systems integration, data analytics & data science, cyber risk, telecommunications network engineering, UX design – and would like to work with technologies such as AWS, Google, Oracle, Salesforce, SAP, Mulesoft, Feedzai and SAS, among others, then you are in the right place!

Learn more at www.deloitte.com/pt/careers.

Keywords: Sobre a Deloitte; Consulting; Technology

#LI-HYBRID  #LI-CA1

#TECHDTT #Experienced