Senior Incident Response & Digital Forensics Analyst

Location: New York • Business Area: Legal, Compliance, and Risk • Ref #: 10054249

About the role

Bloomberg’s Cyber Security Operations Center (CSOC) protects the organization by identifying, investigating, and responding to cyber threats. Working closely with Engineering, Legal, Compliance, and other teams across Bloomberg, CSOC provides security monitoring, incident response, threat hunting, and forensic expertise across a complex global technology environment. As a Senior Incident Response & Digital Forensics Analyst within the Threat Hunting, Intelligence & Incident Response (THIR) team, you will lead the technical investigation of our most complex security incidents and escalations. You will take ambiguous events where the answer is not immediately apparent and drive them to a defensible conclusion. This includes analyzing host, memory, network, and log evidence; acquiring and examining forensic images; investigating suspicious binaries; and reconstructing attacker activity to determine what happened, how it happened, and the extent of impact. During significant incidents, you will help establish ground truth quickly, maintain technical ownership of the investigation, and work with stakeholders across Bloomberg to support an effective response. This role also carries an important leadership expectation: raising the analytical capability of the wider team. Through hands-on mentoring, incident pairing, playbooks, procedures, and structured knowledge sharing, you will help build deeper expertise in areas such as malware analysis, memory forensics, and log-based threat hunting. You will also help shape Bloomberg’s forensic capabilities by contributing to tooling, workflows, investigative standards, and the conversion of lessons learned from incidents into repeatable processes and durable detection coverage.

Responsibilities

• Lead technical investigations of complex security incidents from initial signal through root‑cause analysis and written conclusion.
• Analyze host, memory, network, and log evidence; acquire and examine forensic images.
• Investigate suspicious binaries and reconstruct attacker activity to determine scope and impact.
• Establish ground truth quickly during significant incidents and maintain technical ownership of the investigation.
• Collaborate with stakeholders across Engineering, Legal, Compliance, and other teams to support an effective response.
• Raise the analytical capability of the wider team via hands‑on mentoring, incident pairing, playbooks, procedures, and structured knowledge sharing.
• Build deeper expertise in malware analysis, memory forensics, and log‑based threat hunting.
• Contribute to forensic tooling, workflows, investigative standards, and convert lessons learned into repeatable processes and durable detection coverage.

Requirements

Required experience:

• Substantial hands‑on experience leading security incident investigations end to end, from initial signal through