Senior Digital Forensics & Incident Response (DFIR) Engineer – Microsoft 365

VincaTech1 is looking for an experienced Digital Forensics & Incident Response (DFIR) Engineer for project-based engagements involving employee workstation investigations, Microsoft 365 forensic analysis, insider threat investigations, and incident response. The initial engagement involves conducting a targeted forensic review of a Windows workstation and Microsoft 365 environment to determine whether suspicious activity occurred during approximately the last 90–120 days. This is not a litigation support matter, but the work must follow sound forensic practices and produce a professional report suitable for executive review. This is a contract position with the opportunity for future forensic and cybersecurity projects. Required Experience 7+ years of Digital Forensics and Incident Response experience Experience conducting Windows workstation forensic investigations Experience with Microsoft 365 security investigations Experience with Microsoft Defender for Endpoint Experience with Microsoft Purview Audit Logs Experience with Microsoft Purview eDiscovery Experience investigating insider threats Experience building forensic timelines Experience analyzing Windows Event Logs Experience investigating file access, USB activity, browser history, downloads, and user activity Experience reviewing email activity, OneDrive, SharePoint, and Teams logs Strong report writing skills Must have experience with several of the following: Microsoft Defender for Endpoint Microsoft 365 Defender Microsoft Purview Microsoft Entra ID (Azure AD) Microsoft Sentinel (preferred) FTK EnCase Magnet AXIOM X-Ways Forensics Velociraptor KAPE Autopsy Sysinternals PowerShell