Senior Digital Forensic Investigator

Cohesity

Senior Digital Forensic Investigator overseeing digital forensic investigations and lab operations at Cohesity. Leading complex investigations and ensuring adherence to chain-of-custody protocols in the Santa Clara facility.

Posted 7/15/2026full-timeSanta Clara • California • 🇺🇸 United StatesSenior💰 $176,940 - $196,600 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in digital forensics and cybersecurity investigations, with a strong focus on insider threat analysis, data exfiltration, and employee misconduct. Proficient in producing legally defensible investigation reports and managing forensic laboratory operations while adhering to strict chain-of-custody protocols.

Highest-signal resume keywords

Digital Forensics ExpertiseInsider Threat InvestigationForensic Imaging StandardsEnterprise Forensic PlatformsEDR Platform Proficiency

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital ForensicsForensic AnalysisData ExfiltrationForensic ImagingChain Of CustodyEndpoint ForensicsCloud Forensic InvestigationNetwork-Layer InvestigationMicrosoft 365 ForensicsBehavioral Analysis

Soft Skills

Report WritingOperational Leadership

Tools & Technologies

Magnet AXIOM CyberCellebrite Endpoint CollectorCellebrite Endpoint InvestigatorSumuri ReconCrowdStrike Falcon

Industry Keywords

Cybersecurity InvestigationsSIRTACPOSWGDEEvidentiary Integrity

Tech Stack

Tools & technologies

AzureCloudCyber SecurityDNSMacOS

About the role

Key responsibilities & impact

Lead and execute end-to-end digital forensic investigations across endpoint, cloud, email, identity, and SaaS environments.
Conduct deep-dive analysis for insider threat, data exfiltration, IP theft, fraud, employee misconduct, and ethics matter investigations.
Support SIRT as the Advanced Forensic Tier on high-severity security incidents — establishing attribution, root cause, and precise forensic timelines.
Perform forensic imaging and acquisition of endpoints and storage media in accordance with established forensic standards and chain of custody protocols, ensuring evidence integrity from collection through analysis.
Conduct structured forensic analysis using industry-standard platforms including Magnet AXIOM Cyber, Cellebrite Endpoint Collector, Cellebrite Endpoint Investigator, and Sumuri Recon.
Collect, preserve, and analyze digital evidence in a forensically sound manner, maintaining chain of custody and evidentiary integrity throughout.
Produce executive-quality investigation reports suitable for HR proceedings, legal review, litigation support, and regulatory disclosure.
Manage the Santa Clara Forensic Laboratory as the day-to-day operational lead: oversee evidence intake, storage, processing workflows, and maintain strict adherence to chain-of-custody protocols and forensic standards.

Requirements

What you’ll need

7+ years of progressive experience in digital forensics, cybersecurity investigations, or a closely related discipline.
Demonstrated expertise conducting insider threat, data exfiltration, and employee misconduct investigations in enterprise environments.
Proficiency with enterprise forensic platforms: Magnet AXIOM Cyber, Cellebrite Endpoint Collector and Endpoint Investigator, and Sumuri Recon or comparable tooling.
Strong working knowledge of forensic imaging standards and acquisition methodologies — including write-blocking, hash verification, and documented chain of custody — consistent with industry frameworks such as ACPO, SWGDE, or equivalent.
Hands-on proficiency with EDR platforms — particularly CrowdStrike Falcon — for behavioral analysis, process telemetry, and forensic artifact review.
Strong working knowledge of Microsoft 365 forensics: Exchange Online mail flow and Recoverable Items, Azure AD sign-in and audit logs, Purview Compliance, and MDE.
Solid understanding of endpoint forensics across Windows and macOS: file system artifacts, registry analysis, prefetch/MRU data, browser forensics, and OS-level event logs.
Working knowledge of cloud and SaaS forensic investigation: OAuth and SAML authentication flows, conditional access logs, cloud storage access patterns, and admin audit trails.
Familiarity with network-layer investigation fundamentals: DNS, proxy, VPN, and firewall log analysis sufficient to reconstruct data movement and access patterns.
Proven ability to produce legally defensible, executive-quality investigation reports with precise evidentiary grounding.

Benefits

Comp & perks

Health and wellness benefits
Vacation
Paid holidays
Refresh days
401(k) retirement plan
Life and disability insurance coverages