Skip to content
sec/atlas
all careers

careers

Forensics and Malware Analyst

Reconstruct what happened from the evidence, and explain what the code does.

A forensics analyst collects and examines evidence from memory, disks, logs and cloud services to rebuild an attack, following strict handling rules so it can stand up in a dispute. A malware analyst studies suspicious files to learn what they do and how to detect them. The two roles often work together.

see this path on the journey map

A day in the job

  • Acquire evidence in the right order and prove it was not altered.
  • Analyze memory and disk artifacts and rebuild the timeline of an intrusion.
  • Triage suspicious files in an isolated lab and write detections for what you find.
  • Write reports that separate observation from interpretation and state the limits honestly.
0 of 5 studiedNext topic: The incident response lifecycle

  1. Stage 1· Foundations

    Learn the incident process and where evidence comes from.

    Study here

    Learn elsewhere

    • Operating system internals: Windows and Linux
    • File systems and how data is stored and deleted

    Build this

    Set up an isolated lab with snapshots and practice taking and verifying a disk image of your own test machine.

  2. Stage 2· Practitioner

    Work from logs and scope an intrusion before deep analysis.

    Study here

    Learn elsewhere

    • Windows event logs and common persistence locations
    • Scripting for parsing and automation

    Build this

    Build a combined timeline from three log sources of a simulated intrusion and mark each event with its evidence.

  3. Stage 3· Advanced

    Analyze evidence and samples, and produce detections.

    Study here

    Learn elsewhere

    • Reverse engineering with a disassembler
    • Memory forensics tooling

    Build this

    Analyze a public sample in your lab and publish a short report with indicators and a YARA rule.

What to show

  • A forensic report on a public case image, with method, findings and limits.
  • A malware analysis write-up with static and dynamic findings and the detections that came out of it.

Certifications (examples)

  • GCFE / GCFA (GIAC)
  • GREM (GIAC)
  • EnCE (OpenText)

Examples, not endorsements or requirements. Check the issuer for current details.

Related roles