MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.Incident Response Analyst
When an organisation is attacked, the incident response analyst is the first technical person on the case. The work is fast, the evidence is fragile and the write-up has to be right.
Career guide8 skills6 courses
What the work is
- Triages alerts and compromised machines to decide what is real and what to capture first.
- Collects volatile evidence, memory, running processes and network connections, before systems are rebooted or rebuilt.
- Hunts across endpoints and logs for how the attacker got in, where they moved and what left the network.
- Works with IT teams to contain the attack without destroying the evidence they will later need.
- Reads malware behaviour at a working level and passes samples to a malware analyst for deeper work.
- Writes the incident report: timeline, root cause, scope, data affected and what to fix, and supports reporting duties such as CERT-In notifications.
- Prepares evidence that may later go to the police or a court, so chain of custody still applies in an emergency.
Skills to build
- Windows internals and event log analysis, especially authentication and process creation
- Memory forensics with Volatility
- Endpoint collection at scale with Velociraptor and KAPE
- Log analysis across firewalls, proxies, EDR, Active Directory and cloud consoles
- Network traffic basics and the signs of command and control traffic
- Attacker tradecraft: common intrusion patterns and how ransomware groups operate
- Calm, clear communication with executives who want answers before the facts are in
- The reporting duties under the CERT-In Directions 2022 and the guidance in NIST SP 800-86 on bringing forensics into incident response
Tools you will meet
How the role grows
Stages, not promises. Titles differ between employers and the time each stage takes depends on the cases you get to work on.
- 01SOC Analyst or Junior Responder
Watches alerts, learns what normal looks like on the network and assists on incidents under a lead.
- 02Incident Response Analyst
Runs the technical side of an incident: collection, analysis, containment advice and the report.
- 03Senior Responder or Incident Lead
Coordinates the response across teams, briefs management and makes the judgement calls on scope and containment.
- 04Threat Hunter or DFIR Specialist
Looks for intrusions nobody has reported yet, builds detection from past incidents and handles the most complex cases.
- 05Incident Response Manager
Builds and runs the response function, the playbooks, the on-call arrangements and the relationships with regulators and law enforcement.
Start at DFRTI
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
MalwareIncident Response & Malware AnalysisMalware Reverse EngineeringTake malware apart safely with static and dynamic analysis, Ghidra, x64dbg and YARA.
NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Disciplines to read first
Questions people ask
Is incident response forensics or security?
Both. The security side stops the attack. The forensic side preserves and explains it. Analysts who can do only one tend either to destroy evidence while containing or to watch an attack spread while imaging. The job is holding both at once.
Where should I start?
A background in system administration or a security operations centre gives you the Windows and network knowledge. Memory Forensics is the DFRTI course that turns that into response skill, and Ransomware & Threat Response builds on it.
Do I need to reverse engineer malware?
Not fully. You should be able to read a sandbox report, recognise what a sample does and know when to call a malware analyst. Deep reversing is its own specialisation and DFRTI covers it in Malware Reverse Engineering.
What are the hours like?
Incidents do not keep office hours. Retainer firms and in-house teams usually run on-call rotas. Ask about that before you join.
Career guides describe typical work and skills. They do not promise employment, placement or a salary, and roles vary between employers and countries.
Ready to start?
Tell a counsellor where you are today. They will suggest the first course and the track that leads to this role.