Forensic analyst job description: template and tips

"Forensics" covers very different jobs: investigating after an attack, producing evidence for court, analysing malware, running internal investigations. A job description that does not choose attracts the wrong applicants and drives away the specialists you want. This guide helps you scope the role, then gives you an annotated template and the wording mistakes to avoid.

Start by clarifying the job

Before writing a line, answer one simple question: in what context will the analyst run their investigations? The answer changes the skills, the pace and even the vocabulary of the ad.

Most in-house roles fall into the first row: the forensic analyst is a member of the incident response team who specialises in deep investigation. If that is your case, say so in the title. "DFIR analyst" or "Forensics and incident response analyst" is clearer to candidates and easier to find than a vague "Digital investigation expert".

If what you need is crisis leadership rather than hands-on analysis, our guide on hiring an incident response manager will help you tell the two apart.

What a forensic analyst looks for in a job ad

A good forensic analyst reads a job ad the way they read a case file: looking for facts. They open yours with a few precise questions:

• What will I investigate? Windows endpoints, Linux servers, Active Directory, cloud, mobile: the balance matters.
• With what resources? Remote collection tooling, an EDR, an analysis infrastructure, storage for disk images.
• What pace? How much is crisis work and how much is planned, whether there is on-call, how often on-site work happens.
• What happens to my findings? Technical reports, executive summaries, material passed to a lawyer or an authority.
• Will I have time to grow? Research, tooling development, crisis exercises.

A job description that answers these five questions already stands out from most published ads.

The annotated template

Here is a structure to adapt. Each block is followed by a note on what it should contain.

1. Context

• Who you are: business, size and structure of the security team, reporting line (CSIRT lead, CISO, risk department).
• Why the role exists: building an in-house investigation capability, growing workload, relying less on an external provider.
• Note: candidates want to know whether they are joining a well-equipped team or building everything from scratch. Both can be attractive, as long as you say which.

2. Responsibilities

• Collect and preserve evidence (memory, disks, logs, cloud artefacts) with a documented chain of custody.
• Analyse compromised systems to rebuild the attack timeline: initial access, persistence, lateral movement, exfiltration.
• Triage malicious files and tools found during investigations, and pass indicators of compromise to the detection teams.
• Write usable reports, both technical and executive.
• Contribute to the team's procedures, playbooks and tooling.
• Note: list responsibilities in order of how much time they really take. If writing takes a large share, say so: it is the point that most often surprises new hires.

3. Requirements

• Three to five must-have skills, written as observable abilities.
• Two to four nice-to-haves, clearly separated.
• Note: the next section covers this split, which decides who dares to apply.

4. Conditions

• Location, remote work policy, how often the analyst travels to clients or remote sites.
• On-call: frequency, organisation, compensation.
• Salary range.
• Training budget, research time, exercises or conferences.
• Any security clearance requirement, and what it involves in practice.
• Note: on-call is often the first thing candidates weigh for this job. Staying silent on it breeds suspicion.

5. Hiring process

• The steps, how many and roughly how long.
• What the technical assessment involves.
• Note: see the dedicated section below.

Must-have or nice-to-have: make the cut

The endless list is the most common mistake. The best analysts know they do not master everything, and an ad demanding memory analysis, advanced reverse engineering, mobile and expert witness work all at once discourages strong people and attracts those who tick every box without depth.

Must-have, for example for a mid-level in-house DFIR role:

• Investigate a compromised Windows endpoint and produce a reasoned timeline.
• Use Windows and Active Directory event logs to trace an attacker's movements.
• Collect evidence without altering it and document every step.
• Write a report that clearly separates established facts from hypotheses.

Nice-to-have:

• Investigations in cloud or Microsoft 365 environments.
• Memory analysis.
• Static or dynamic malware triage.
• Scripting to automate artefact collection or processing (Python, PowerShell or similar).

Describe skills as actions, not tool names. "Can rebuild lateral movement from authentication logs" says far more than "proficient with forensic tools". Tools change; the investigative approach stays.

For how much weight to give specialist certifications, see our article on cybersecurity certifications in hiring. Require one only if a client or a qualification demands it, and explain why. If you are a provider working towards the French ANSSI PRIS qualification, mention it: it tells candidates what level of methodological rigour to expect.

Wording mistakes that drive people away

• A vague context: without knowing whether this is incident response, expert witness work or internal investigation, candidates cannot picture the job.
• The catch-all role: a forensic analyst who also runs the SIEM, manages firewalls and drives compliance will never have time to investigate.
• Years of experience as the only bar: describe the expected level of autonomy instead. Some strong profiles come from a SOC, from system administration or from a career change.
• Silence on on-call and crisis work: a hire who discovers the real pace after joining will leave quickly.
• Empty buzzwords: "passionate", "recognised expert". Candidates would rather read what they will investigate next week.
• No salary: without a range, many approached candidates will not bother to reply.

Describe the assessment process

A forensic analyst should be judged on their approach, not on reciting artefact locations. Describe a short, predictable process in the ad:

1. A first conversation about background, the role's context and expectations.
2. A hands-on exercise: a realistic dataset (disk image, log extracts, memory capture) to analyse within a set time.
3. A technical interview where the candidate presents their findings and explains how they reached them, with a peer from the team.
4. A final conversation with the manager.

State how long the exercise takes and what it assesses: method, quality of documentation, the ability to say "I don't know yet". To prepare the technical interview, our list of interview questions for an incident response analyst largely applies to this role, and our guide on assessing cybersecurity skills covers how to use hands-on labs.

Where to post your job description

• Your careers site, with a stable URL: it is the reference candidates check.
• LinkedIn, ideally shared by the technical members of the team.
• DFIR communities: security conferences, associations, specialist discussion groups, following their posting rules.
• The CTF and training ecosystem, where forensics and investigation categories attract people who practise regularly.
• Direct outreach, often essential. Experienced analysts are rarely job hunting: a precise job description then backs up a personal message.

In short

A good forensic analyst job description starts by choosing the investigation context, describes real responsibilities and their weight, separates must-haves from nice-to-haves, is honest about the pace of the job and announces an assessment based on a concrete case. It gives the right candidate the facts they need to decide.

Opening a forensic or DFIR analyst role? At Cyber Recrut, a recruiter and a security practitioner scope the job description with you, then our shortlisted candidates prove their skills on investigation labs close to your environment. See how we work or tell us about your hiring need.