{"id":1768713,"url":"https://alion.io/job/bloomberg-senior-incident-response-digital-forensics-analyst-2","title":"Senior Incident Response & Digital Forensics Analyst","company":{"id":7892,"name":"Bloomberg","domain":"bloomberg.com","url":"https://alion.io/company/bloomberg","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Avature","truth_index":{"grade":"A","score":100,"open_postings":24,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":15,"computed_at":"2026-10-20T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":190000,"max":260000,"currency":"USD","period":"year","gross":null,"usd_annual":260000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Carbon Black","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"Jira","optional":false},{"name":"Linux","optional":false},{"name":"osquery","optional":false},{"name":"Python","optional":false},{"name":"Snort","optional":false},{"name":"Splunk","optional":false},{"name":"Suricata","optional":false},{"name":"Sysmon","optional":false},{"name":"Tanium","optional":false},{"name":"TCP/IP","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"Zeek","optional":false}],"status":"live","first_seen_at":"2026-10-03T14:43:46Z","employer_posted_date":"2026-10-03","last_verified_at":"2026-10-20T08:54:28Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"Cyber Security Operations Center - Threat Hunting, Intelligence & Incident Response\n\nThe Role\nBloomberg’s Cyber Security Operations Center (CSOC) protects the organization by identifying, investigating, and responding to cyber threats. Working closely with Engineering, Legal, Compliance, and other teams across Bloomberg, CSOC provides security monitoring, incident response, threat hunting, and forensic expertise across a complex global technology environment.\nAs a Senior Incident Response & Digital Forensics Analyst within the Threat Hunting, Intelligence & Incident Response (THIR) team, you will lead the technical investigation of our most complex security incidents and escalations.\nYou will take ambiguous events where the answer is not immediately apparent and drive them to a defensible conclusion. This includes analyzing host, memory, network, and log evidence; acquiring and examining forensic images; investigating suspicious binaries; and reconstructing attacker activity to determine what happened, how it happened, and the extent of impact.\nDuring significant incidents, you will help establish ground truth quickly, maintain technical ownership of the investigation, and work with stakeholders across Bloomberg to support an effective response.\nThis role also carries an important leadership expectation: raising the analytical capability of the wider team. Through hands-on mentoring, incident pairing, playbooks, procedures, and structured knowledge sharing, you will help build deeper expertise in areas such as malware analysis, memory forensics, and log-based threat hunting.\nYou will also help shape Bloomberg’s forensic capabilities by contributing to tooling, workflows, investigative standards, and the conversion of lessons learned from incidents into repeatable processes and durable detection coverage.\n\nWhat You’ll Bring\nSubstantial hands-on experience leading security incident investigations end to end, from initial signal through root-cause analysis and written conclusion.\nStrong practical experience with disk and memory forensics across Windows and Linux, including evidence acquisition and analysis.\nDemonstrated malware analysis experience, including static and dynamic analysis, safe detonation, and extraction of useful observables for detection and threat hunting.\nStrong knowledge of operating-system internals across Windows, Linux, and macOS.\nStrong understanding of networking fundamentals, including TCP/IP, DNS, routing, and network evidence analysis.\nDeep hands-on experience investigating large datasets using Splunk or a comparable enterprise search and log-analysis platform.\nExperience using endpoint and network telemetry to determine attacker behavior and identify additional evidence when existing visibility is insufficient.\nProgramming or scripting capability in any language; Python is commonly used within the team.\nThe ability to investigate difficult and unfamiliar problems independently while knowing when to involve others or seek additional expertise.\nStrong written and verbal communication skills, including the ability to explain investigative findings and reasoning clearly.\n\nExperience in one or more of the following areas would be beneficial:\nMemory-forensics frameworks such as Volatility and structured forensic acquisition tooling.\nReverse engineering beyond behavioral malware analysis.\nCloud forensics across AWS, Azure, or GCP, including snapshot-based acquisition and investigation.\nThreat hunting and knowledge of attacker tools, techniques, and procedures used against enterprise environments.\nCrowdStrike Falcon, particularly Real Time Response (RTR), for remote artifact and evidence collection.\nHumio / LogScale or other large-scale log-analysis platforms.\nEndpoint telemetry and EDR technologies such as osquery, Sysmon, Carbon Black, or Tanium.\nNetwork security monitoring technologies such as Zeek, Suricata, Snort, NetWitness, packet capture, or network IDS.\nWorking with detection engineering teams to translate investigative findings into sustainable detection coverage.\nGit, Jira, Jupyter notebooks, or similar development and collaboration tools.\nRelevant certifications such as GCFA, GCFE, GREM, or GNFA.\nExperience applying mainstream commercial AI platforms to security or analytical workflows.\n\nWe look for people who demonstrate:\nCuriosity and problem solving - You explore the unknown, ask good questions, seek evidence, and methodically work through difficult problems.\nPersistence - You stay engaged when investigations become complex, incomplete, or difficult to resolve.\nCandor and humility - You are confident in your expertise while being open about what you do not know, receptive to feedback, and willing to involve others.\nLearning agility - You can quickly develop knowledge of unfamiliar technologies, environments, and investigative techniques.\nCollaboration and empathy - You work effectively with people from different technical disciplines, cultures, and backgrounds and respect different perspectives.\nKnowledge sharing - You actively help others improve through mentoring, documentation, pairing, and practical knowledge transfer.\n\nHow We Work\nTHIS is a globally distributed team across New York, EMEA, and APAC. Our follow-the-sun model allows investigations and operational work to transition between regions rather than routinely requiring teams to work outside normal hours.\nThe role is shift-oriented, and significant incidents may occasionally require support outside standard working hours. When that happens, the team works together globally to manage the response.\n\nLife at Bloomberg\n\nBloomberg operates in a fast-moving, collaborative environment where people are encouraged to contribute ideas regardless of title. We value high standards, trust, curiosity, teamwork, and giving back to the communities in which we operate.\nIf this sounds like an environment where you would thrive, we would like to hear from you.\nBloomberg is an equal opportunities employer. We value diversity and do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or other protected characteristics.\nSalary Range = 190,000 - 260,000 USD Annual + Benefits + Bonus\nThe referenced salary range is based on the Company's good faith belief at the time of posting. Actual compensation may vary based on factors such as geographic location, work experience, market conditions, education/training and skill level.\nWe offer one of the most comprehensive and generous benefits plans available and offer a range of total rewards that may include merit increases, incentive compensation (exempt roles only), paid holidays, paid time off, medical, dental, vision, short and long term disability benefits, 401(k) +match, life insurance, and various wellness programs, among others. The Company does not provide benefits directly to contingent workers/contractors and interns.\nDiscover what makes Bloomberg unique - watch our podcast series for an inside look at our culture, values, and the people behind our success.","description_format":"text","description_chars":7114,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance","Wellness"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Financial Data & Market Intelligence","Financial News & Media"],"lifecycle":[{"event":"open","at":"2026-10-03T14:43:46Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 434 · green card filings: 457","filings_12m":434,"filings_prev_12m":472,"green_card_filings_12m":457,"median_offered_wage_usd":165065,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":16}],"liveness":{"score":43,"band":"fade","label":"Fading","p_open":1,"p_active":0.778,"p_room":0.55,"age_days":16,"expected_fill_days":15,"reasons":["conf:1","velocity","win:tail","comp:brand"],"computed_at":"2026-10-20T05:45:00Z"},"pay":{"stated_usd_annual":260000,"is_top_pay":true},"html_url":"https://alion.io/job/bloomberg-senior-incident-response-digital-forensics-analyst-2","json_url":"https://alion.io/job/bloomberg-senior-incident-response-digital-forensics-analyst-2.json","meta":{"generated_at":"2026-10-20T13:24:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14867,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7892},"rest":"https://alion.io/mcp/rest/get_company?id=7892"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbloomberg-senior-incident-response-digital-forensics-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbloomberg-senior-incident-response-digital-forensics-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbloomberg-senior-incident-response-digital-forensics-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bloomberg-senior-incident-response-digital-forensics-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbloomberg-senior-incident-response-digital-forensics-analyst-2"}]}