Senior Engineer – Network Forensics, Incident Response

Verizon

. Serve as technical lead for network digital forensics and incident response across the Network Security Defense portfolio .

Posted 10/14/2026full-timeUnited StatesSenior💰 $101,000 - $194,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in digital forensics and incident response, with a strong focus on network security, threat analysis, and forensic evidence management. Proficient in developing and executing DFIR strategies, playbooks, and reports while collaborating effectively with technical and executive stakeholders.

Highest-signal resume keywords

Digital ForensicsIncident ResponseNetwork Security EngineeringSIEM/Data Analysis PlatformsForensic Acquisition and Analysis Suites

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital ForensicsIncident ResponseNetwork Security EngineeringForensic AcquisitionData AnalysisTCP/IPBGPOSPFPythonPowerShell

Soft Skills

Effective CommunicationTechnical LeadershipMentoringInterpersonal SkillsResults Management

Tools & Technologies

SplunkELKEnCaseFTKVolatilityX-WaysSANS SIFTKAPEKubernetesOpenStack

Certifications & Qualifications

GNFAGCFAGCIHCCE

Industry Keywords

DFIRMITRE ATT&CKNetwork InfrastructureCloud Environments4G/5G Wireless NetworksCarrier-Grade IP NetworksThreat IntelligenceRoot Cause AnalysisEvidence AnalysisNetwork Recovery

Tech Stack

Tools & technologies

CloudCyber SecurityDNSKubernetesOpenStackPythonSplunkTCP/IP

About the role

Key responsibilities & impact

Serve as technical lead for network digital forensics and incident response across the Network Security Defense portfolio
Lead technical investigations and incident response during major security events
Collect, preserve, and analyze forensic evidence across network infrastructure, edge routers, switches, cloud environments, and specialized network functions
Drive containment, root-cause analysis, threat eradication, and network recovery during major incidents
Analyze PCAP, NetFlow/IPFIX, firewall logs, and router/switch artifacts to trace lateral movement and data exfiltration
Analyze memory dumps, volatile network state, process execution artifacts, and compromised system state
Architect, author, and maintain custom YARA rules for memory analysis, file carving, binary inspection, and artifact matching
Hunt threats, dissect APT tactics, techniques, and procedures, extract IOCs, and convert findings into actionable detections
Automate artifact collection, evidence ingestion, and triage workflows
Develop and refine DFIR playbooks and runbooks for major security incidents
Produce forensic investigation reports covering attack timelines, root cause, evidence analysis, impact assessment, and remediation recommendations
Strengthen network visibility and forensic readiness across the Defense organization
Work with diverse technical, business, and executive stakeholders

Requirements

What you’ll need

Bachelor’s degree or four or more years of relevant work experience
Four or more years of relevant work experience in digital forensics, network security engineering, or incident response, demonstrated through work and/or military experience or specialized training
Deep experience with SIEM/data analysis platforms, including Splunk and ELK
Strong proficiency in forensic acquisition and analysis suites, including EnCase, FTK, Volatility, X-Ways, SANS SIFT, and KAPE
Expert knowledge of TCP/IP, BGP, OSPF, DNS, TLS, HTTP/S, NetFlow, IPFIX, and syslog
Industry-recognized DFIR certifications such as GNFA, GCFA, GCIH, or CCE are advantageous
Experience with 4G/5G wireless network functions, carrier-grade IP networks, or Kubernetes, OpenStack, and KVM is advantageous
Proficiency in Python, PowerShell, or Bash for forensic artifact collection and processing is advantageous
Knowledge of the MITRE ATT&CK framework and enterprise threat intelligence integration is advantageous
Effective written, interpersonal, and verbal communication skills
Demonstrated technical leadership during major cybersecurity incidents
Ability to work with technical engineering teams, business owners, and executives
Leadership and mentoring abilities
Proven ability to manage and deliver results under high-pressure security incident scenarios
Ability to work in a hybrid arrangement with a minimum of three days per week in the office

Benefits

Comp & perks

Medical, dental, and vision insurance
Short- and long-term disability insurance
Basic and supplemental life insurance
AD&D insurance
Identity theft protection
Pet insurance
Group home and auto insurance
Matched 401(k) savings plan
Up to 8 company-paid holidays per year
Up to 6 personal days per year
Paid parental leave
Adoption assistance
Tuition assistance
Other incentives
Premium pay such as overtime, shift differential, holiday pay, and allowances, depending on the role
Up to 15 days of vacation per year for newly hired employees, increasing with additional service