Cohesity

Cohesity

Senior Digital Forensic Investigator

Santa Clara, CA - USA (Office) · Senior

Sponsorship not specifiedDetected 1 day ago
PythonPowerShellAzureCloud PlatformsOAuthNLPLLMsCybersecurityDetection EngineeringIncident ResponseDNSFirewallVPNLeadershipCommunicationCritical ThinkingCISSP

About the role

  • Interested candidates based outside of the designated areas are welcome to apply, provided they have the indefinite right to work in the job location.
  • Cohesity is a leader in AI-powered data security and management.

Responsibilities

  • Perform advanced log analysis in Google SecOps/Chronicle (YARA-L) and Splunk (SPL).
  • Query device management platforms (JAMF, Intune, SCCM) to build custodian device profiles and establish asset attribution in support of investigations.
  • Design and build AI-assisted investigative workflows using platforms such as Anthropic Claude, Microsoft Copilot, and related enterprise AI tools.
  • Develop prompt engineering frameworks, structured analysis pipelines, and automation logic that apply large language models to forensic triage, timeline reconstruction, and report drafting.
  • Evaluate emerging AI capabilities for investigative applicability and lead proof-of-concept development within the team's forensic environment.
  • Lead and execute end-to-end digital forensic investigations across endpoint, cloud, email, identity, and SaaS environments.
  • Support SIRT as the Advanced Forensic Tier on high-severity security incidents - establishing attribution, root cause, and precise forensic timelines.
  • Perform forensic imaging and acquisition of endpoints and storage media in accordance with established forensic standards and chain of custody protocols, ensuring evidence integrity from collection through analysis.
  • Produce executive-quality investigation reports suitable for HR proceedings, legal review, litigation support, and regulatory disclosure.
  • Manage the Santa Clara Forensic Laboratory as the day-to-day operational lead: oversee evidence intake, storage, processing workflows, and maintain strict adherence to chain-of-custody protocols and forensic standards.

Requirements

  • This role combines hands-on forensic expertise with lab management and operational leadership.
  • Hands-on proficiency with EDR platforms - particularly CrowdStrike Falcon - for behavioral analysis, process telemetry, and forensic artifact review.
  • Proficiency in Google SecOps/Chronicle (YARA-L) for investigation and threat hunting.
  • Experience using device management platforms (JAMF, Intune, SCCM) for custodian device attribution and asset profiling in the context of investigations.
  • Proven ability to produce legally defensible, executive-quality investigation reports with precise evidentiary grounding.
  • Experience supporting eDiscovery processes, including ESI collection, legal hold execution, and custodian data scoping.
  • Demonstrated hands-on experience using large language model (LLM) platforms - such as Anthropic Claude or Microsoft Copilot - to augment investigative, analytical, or reporting workflows.
  • Comfort evaluating AI-generated output critically - understanding where LLM reasoning aids investigation and where human judgment must govern evidentiary conclusions.
  • The ability to operate independently with minimal oversight, making sound judgments under ambiguity.
  • comfort working with incomplete or conflicting data.

Nice to have

  • Experience working within or directly supporting corporate Legal, HR, or Ethics functions on sensitive employment or litigation matters.
  • Solid grounding in incident response methodology - including initial triage, scoping, containment sequencing, and post-incident analysis - with experience leading or co-leading high-impact security incidents.
  • Proficiency in Google SecOps/Chronicle and Splunk (SPL).
  • Familiarity with Zscaler proxy log analysis and cloud access security broker (CASB) telemetry.
  • Prior experience testifying or providing declarations in legal, arbitration, or regulatory proceedings.
  • Relevant certifications: GCFE, GCFA, EnCE, CFCE, CISSP, or equivalent.
  • What You Need to Succeed
  • Beyond technical skill, this role demands a specific kind of professional character.

Compensation

  • Disclosure Pursuant to Applicable State Equal Pay Transparency Laws - This position has a starting pay range as listed below.
Apply directly at Cohesity →Create a free account for alerts like thisView Cohesity immigration profile

This listing is sourced directly from Cohesity's careers page and normalized into a canonical job model.