Lead Security Analyst (Digital Forensics and Incident Response))

About the role

This is a new role within Gartner's Security Operations team, focused on Digital Forensics and Incident Response (DFIR). As a Lead Analyst, you will be responsible for leading complex investigations, conducting forensic analysis across enterprise systems, and helping Gartner respond to, contain, and recover from cybersecurity incidents. You will serve as a technical leader for investigations involving advanced threats, insider risk, legal and regulatory matters, and high-priority security events. This role requires deep expertise in digital forensics, evidence handling, incident response, and threat analysis, combined with the ability to communicate findings clearly to technical and non-technical audiences. As part of a highly collaborative team, you will work closely with teams such as Security Operations, Threat Intelligence, Legal, Human Resources, Privacy, Compliance and Engineering to protect Gartner's people, data and intellectual property.

Responsibilities

• Lead digital forensic investigations involving cybersecurity incidents, insider threats, human resources matters, legal requests, and regulatory inquiries.
• Conduct forensic acquisition and analysis of endpoints, cloud workloads, network artifacts, log data, and volatile system evidence.
• Develop and maintain DFIR playbooks and standard operating procedures that meet legal and evidentiary standards.
• Perform advanced log analysis using multiple data sources to establish timelines, identify root cause, and validate investigative findings.
• Develop automation and tooling that improve investigative efficiency and evidence collection capabilities.
• Identify opportunities to improve Gartner's detection, response, forensic readiness, and evidence preservation capabilities.
• Mentor junior investigators and contribute to the growth and maturity of Gartner's DFIR program.
• Produce clear and defensible forensic reports suitable for internal stakeholders, auditors, legal counsel, and executive leadership.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, related fields, or equivalent practical experience.
• 7+ years of experience in digital forensics and incident response, with at least 2 years in a senior or lead capacity, including experience leading complex incident