Detection and response
DFIR Analyst
Investigate incidents, reconstruct timelines and lead containment with customers. Your casework feeds back into the platform's digital forensics and incident response capabilities.
About the role
Why this role exists
When a customer has an incident, they need someone calm and methodical who can work out what happened, stop it spreading and explain it clearly. This role does that work directly with customers, as part of the detection and response team behind our 24/7 response function at soc@prava.dev.
Every case teaches something. You will turn what you learn into improvements to the platform's forensics and response features: what evidence should be collected automatically, which artefacts matter, and how the Prava AI assistant should help an analyst build a timeline. Your work makes the next investigation faster for every customer.
You will own investigations from first triage to the final report, working with the customer's team and with colleagues in detection engineering, threat intelligence and malware analysis.
Responsibilities
What you will do
- Triage incoming incidents, set scope and priorities, and agree a plan with the customer.
- Collect and preserve evidence from endpoints, servers, cloud logs and identity systems, keeping a documented chain of custody.
- Analyse memory, disk and log artefacts to reconstruct timelines of attacker activity.
- Lead containment and eradication with the customer's team, balancing speed against the risk of disruption.
- Write clear incident reports for both technical and executive readers, separating what is known from what is inferred.
- Feed findings back into detections, playbooks and the platform's forensics features.
- Take part in an on-call rotation for the 24/7 response function. [On-call arrangements]
Requirements
What you will bring
We care about what you can do, not where or how you learned it. If you meet most of these, we would like to hear from you.
- Experience investigating real security incidents, in an internal team, a consultancy or a managed service.
- Practical forensic skills on Windows and at least one of Linux or macOS, including memory and disk analysis.
- Experience investigating cloud and identity incidents using provider audit logs.
- The ability to build and defend a timeline from incomplete evidence.
- Clear writing and the composure to brief a customer during a stressful incident.
- Scripting ability, for example in Python or PowerShell, to parse and correlate evidence at scale.
- A disciplined approach to evidence handling and documentation.
Nice to have
Helpful, not required
Malware
Reverse engineering
Enough to triage a sample and extract indicators, or the interest to learn.
Ransomware
Recovery experience
Experience supporting recovery and negotiation-free restoration after ransomware.
Scale
Fleet-wide response
Experience running investigations across thousands of endpoints.
Legal
Expert evidence
Familiarity with preparing evidence that may be used in legal or regulatory processes.
Your first months
What progress looks like
These are typical outcomes, not fixed targets. Your manager will agree goals with you when you join.
First month
Settle in
You have learned our response process, tooling and reporting standards, and shadowed live or recent cases with the team.
First three months
Contribute
You are leading investigations with support, and you have proposed at least one improvement to a playbook or forensic collection based on your casework.
First six months
Own
You lead cases independently, mentor others on part of the craft, and have shaped a forensics or response feature in the platform.
Tools and environment
How you will work
You will work with tools such as Volatility, Velociraptor, KAPE, the Eric Zimmerman tools, Plaso, Wireshark and YARA, together with cloud provider audit logs and log search platforms. Much of the work also happens through Prava AI's own forensics and response features.
Specific internal tooling and case management processes are covered during onboarding.
Hiring process
How we hire for this role
This follows our usual hiring process, adapted to the role. We reply to every application and tell you in advance what each stage involves.
- Application. Your CV and a short note about the kinds of incidents you have worked.
- Introductory call. Your experience, how you like to work under pressure and what you want next.
- Technical conversation. A walk through an investigation you led, with confidential details removed.
- Practical exercise. A scoped analysis of a synthetic evidence set, with a short written summary. We do not use your work in our product.
- Final conversations and offer. Time with leadership, then a written offer from an @prava.dev address.
Security and ethics
Working responsibly
Note. DFIR work happens only under written authorisation from the customer and in line with our Acceptable Use Policy. Customer evidence is handled under strict confidentiality and stays in the customer's region. Because the role involves access to sensitive data, offers may be subject to background checks where the law allows.
We never ask candidates for payment, bank details or fees, and interviews and offers come only from @prava.dev addresses. Read more about recruitment fraud and how we handle your application data under our Privacy Policy.
Benefits
What we offer
Benefits vary by country and employing entity, and the specifics are set out in each offer. They include pay set for the role and location, health cover, paid leave, support for learning, the equipment you need and working arrangements that suit the role. See benefits on the careers page. We are an equal opportunity employer; if you need an adjustment at any stage, tell us at careers@prava.dev.
Other open roles
Explore the team
- Security Researcher (Offensive) · Research
- Machine Learning Engineer (Security LLM) · AI
- Threat Intelligence Analyst (Dark Web) · Intelligence
- Backend Engineer (Platform) · Engineering
- Detection Engineer · Detection and response
- Solutions Engineer · Customers
- Compliance and GRC Specialist · Customers
Do not see the right fit? Send a general application.
Next step
Apply for this role
Send your CV and a short note about an investigation you are proud of, without confidential details. Public write-ups, talks or tools are welcome; describe your part and credit collaborators fairly. The Apply button opens an email to careers@prava.dev with the role in the subject line.