Perform live-state memory captures, extract Master File Tables (MFT), and collect forensic system artifacts across Windows, Linux, and macOS endpoints using enterprise tools.
Reconstruct complex, multi-stage attack timelines by correlating telemetry across cloud infrastructure (AWS/Azure/GCP), local identity nodes, network firewall pipes, and application layers
Conduct behavioral malware analysis to quickly isolate Indicators of Compromise (IoCs), identify command-and-control (C2) servers, and decipher attacker capabilities.
Convert findings from active breaches into automated incident response playbooks within the corporate SOAR platform.
Maintain pristine evidentiary standards and strict chain-of-custody documentation to support potential regulatory disclosures, insurance claims, or legal actions.
Author detailed Root Cause Analysis (RCA) records and Post-Incident Reports (PIR) for executive lead...