Senior Specialist, Incident Response

About the Company

At SITA, we keep airports moving, airlines flying smoothly, and borders open. Our technology and communication innovations power the success of the global air travel industry. You'll find us in 95% of international airports, working closely with over 2,500 transportation and government clients.

About the Role

As a Digital Forensics & Incident Response (DFIR) Specialist, you will play a key role in investigating cybersecurity incidents, performing forensic analysis, and supporting readiness and cyber resilience while supporting the protection of SITA, its customers, and the broader air transport ecosystem. This role is ideal for a proactive hands-on security professional with strong investigation and analytical skills who is passionate about incident response, digital forensics, and continuous improvement.

Key Responsibilities

• Incident Response & Coordination: Investigate security incidents across the full incident response lifecycle, including analysis, containment, eradication, recovery, and post-incident activities; support the coordination of incident response activities with SOC, CSIRT Threat, Corporate IT, Cloud & Infrastructure, Product Engineering, and other stakeholders; contribute to incident reports, technical findings, lessons learned, and remediation recommendations; assist in maintaining and improving incident response processes, playbooks, and operational procedures
• Digital Forensics & Evidence Handling: Conduct forensic acquisition, preservation, analysis, and reporting of evidence from endpoints, servers, cloud environments, networks, and SaaS platforms; maintain accurate documentation and evidence handling procedures in accordance with legal, regulatory, and industry best practices; analyse artifacts to identify attacker activity, determine root cause, and assess business impact; support investigations involving malware, ransomware, account compromise, data exfiltration, and unauthorized access
• Insider Threat & Risk: Assist with investigations involving insider threats, policy violations, misuse of privileged access, and potential data loss events; support Legal, Compliance, HR, and other stakeholders by providing technical evidence and investigative findings; help identify control improvements to reduce insider threat risks and strengthen overall security posture
• Tooling, Automation & Telemetry: Develop and maintain scripts and automation to support evidence collection, analysis, and incident response workflows; utilize AI-driven capabilities and security analytics to improve investigative efficiency and response outcomes; work with platform owners to improve logging, telemetry visibility, and forensic readiness across enterprise environments; contribute to the ongoing enhancement of DFIR capabilities, tooling, and operational processes

Essential Requirements

• Experience in digital forensics, incident response, or cyber investigations within enterprise environments
• Hands-on experience with EDR/XDR, SIEM, forensic investigation, and related security tooling
• Relevant certifications such as GCIH, GREM, GCFE, CISSP, or OSCP
• Experience with cloud security and DFIR investigations across Azure, AWS, and/or GCP environments
• Experience with forensic frameworks and tools such as FTK, EnCase, Velociraptor, KAPE, Autopsy, or Volatility

Desirable

• Experience working in aviation, transportation, critical infrastructure, or operational technology (OT) environments
• Knowledge of security automation, orchestration, and AI-assisted investigation techniques to improve response efficiency

Benefits

Flex Week (work from home up to 2 days/week depending on team needs), Flex Day, and Flex-Location options.

How to Apply

Apply via the link provided.