Jobs in Portugal, in English.
13,000+ live jobsDigital Forensics & Incident Response Specialist in Lisbon
On-site in Lisbon·Added 6 days ago (last checked 7 Nov)
97 open roles
Our summary
- Work mode
- On-site, Lisbon
- Experience
- 6+ years
Skills
Deloitte Portugal is hiring for this role in several places. This vacancy is in Lisbon.
This job advert was originally written in Portuguese.
Requirements
What we're looking for
- More than 6 years of experience in Digital Forensics, Incident Response, SOC, Threat Hunting, or a related cybersecurity role.
- Solid knowledge of Incident Response methodologies and Digital Forensics processes.
- Hands-on experience investigating security incidents related to endpoints, identities, email, networks, and cloud environments.
- Proven experience responding to critical DFIR situations, including emergency activation, rapid triage, coordination of containment measures, and evidence preservation in high-pressure contexts.
- Previous experience participating in on-site incident response interventions and direct contact with clients, technical teams, legal departments, and executive stakeholders during active incidents.
- Availability to join an on-call rotation and travel on short notice, including international travel, whenever necessary in the context of an active incident.
- Experience in forensic collection, evidence preservation, and compliance with chain of custody procedures.
- Practical knowledge of tactics and techniques used by attackers, mapped to MITRE ATT&CK.
- Ability to correlate evidence from different sources and build solid, sustained incident timelines.
- Strong analytical, investigative, documentation, and communication skills.
- Ability to maintain effectiveness during high-pressure incidents subject to critical deadlines.
Nice to have
- Experience in MSSP/MDR environments, consulting, or multi-client contexts.
- Experience in investigations related to ransomware, BEC, identity compromise, and incidents in cloud environments.
- Skills in malware triage, memory forensic analysis, and network forensic analysis.
- Knowledge of Python, PowerShell, or other scripting languages for the automation of forensic activities.
- Experience supporting legal, regulatory, cyber risk insurance, or law enforcement processes.
Relevant certifications, such as GIAC GCFA, GCIH, GCFE, GNFA, EnCE, CFCE, Microsoft SC-200, or CrowdStrike certifications.
The role
Do you want to join one of the largest professional services organizations in the market?
Then Deloitte is for you. Here, you will have the possibility to boost your career and strengthen your skills in our technological universe.
We are an international Tech Hub and we are looking for the best Infrastructure Engineers to join our centers of excellence and our community. At Deloitte, you will transform the world as we know it and develop unique and innovative solutions in the most varied and complex transformation projects, from Portugal to the world. We are going to strengthen our area and we are looking for experienced professionals who have a natural taste and aptitude for working in teams and in multi-project environments. You can discover all the roles you will perform, according to your profile, so that you can take a leap in your career!
Will you join us? We are waiting for you.
What you'll do
- Lead and support the entire cybersecurity incident response process, from initial triage to containment, eradication, recovery, and analysis of lessons learned.
- Perform forensic collection and analysis of endpoints, servers, cloud environments, email platforms, and network evidence.
- Investigate ransomware incidents, Business Email Compromise (BEC), account compromise, insider threats, data exfiltration, and Advanced Persistent Threats (APTs).
- Collect, preserve, and document digital evidence, in compliance with chain of custody and forensic integrity requirements.
- Analyze Windows, Linux, and macOS artifacts, including event logs, registry data, file systems, memory, browser activity, and persistence mechanisms.
- Investigate activities in Microsoft 365 and Entra ID, including logins, mailbox audit events, OAuth applications, email rules, and identity compromise.
- Perform timeline analysis to reconstruct attacker activity and identify initial access, lateral movement, persistence mechanisms, and incident impact.
- Analyze memory captures, disk images, suspicious files, scripts, malware behaviors, and network traffic.
- Develop and execute investigation queries through SIEM, EDR, and XDR platforms.
- Coordinate containment and remediation actions with SOC, IT, Cloud, Legal, and Privacy teams, as well as with business area stakeholders.
- Participate in on-site emergency DFIR interventions, traveling to client or organizational facilities to support urgent incident containment, evidence collection, and forensic investigation.
- Participate in an on-call rotation and maintain availability to respond to critical cybersecurity incidents outside of normal working hours, including nights, weekends, and holidays, whenever necessary.
- Travel nationally and internationally on short notice to support high-criticality incidents and urgent forensic activities.
- Produce clear reports on incidents, forensic findings, executive summaries, and remediation recommendations.
- Contribute to the development of Incident Response playbooks, tabletop exercises, and continuous improvement initiatives.
Technical and Management Knowledge
Experience with some of the following technologies and investigation areas:
- Digital Forensics & Analysis: EnCase / FTK; Magnet AXIOM; Autopsy / Sleuth Kit; Volatility; KAPE / Velociraptor.
- Incident Response: Microsoft Defender XDR; CrowdStrike Falcon; Microsoft Sentinel; Splunk; Wireshark.
- Platforms & Methods: Windows / Linux / macOS; Microsoft 365 / Entra ID; Azure / AWS; MITRE ATT&CK; NIST / SANS IR.
Develop a career tailored to you
- In a diverse work context that allows for continuous development and learning;
- Through a personalized career development plan (skills/technical and functional opportunities), suited to the moment, your needs, and your objectives;
- By participating in national and international projects, with relevant dimension and impact in this area of specialization;
- Unlimited access to the largest online learning platforms (Linkedin Learning and Udemy);
- Opportunity for training and certifications in the latest technologies, specifically in Cloud technologies.
Experience a culture of unity
- A culture of innovation and excellence that makes us leaders and trendsetters;
- A friendly environment of respect, trust, transparency, and informality;
- A lifelong network that keeps you connected to the best knowledge alongside leaders and specialists;
- An opportunity to be part of our communities (Tech, innovation, sports, and other interests) and to actively participate in social responsibility projects.
About Deloitte Portugal
- Industry
- Consulting
In their own words
About the company & team
At Deloitte, you will never work alone. You will have the opportunity to join various transformation projects and be part of a team that will inspire you and help you develop differentiating solutions, in a dynamic and collaborative environment, where you can give your best and benefit from our well-being and flexibility initiatives. We are more than 5,500 people in Portugal, of which more than 2,600 work in technological areas, from offices and Digital Studios in Lisbon, Porto, Braga, Viseu, Coimbra, and Faro, and from technological hubs in Braga. Furthermore, our teams in Portugal have international projection, which demonstrates our strong global leadership in low code/no code, in telecommunications network engineering, in organizational transformation technological platforms (ServiceNow and Apptio), and in the financial services industry (Finastra, TIA, and Guidewire).
If you are interested in exploring and developing your skills in any of these technological solution areas - software engineering, cloud, systems integration, data analytics & data science, cyber risk, telecommunications network engineering, UX design - and would like to work with technologies such as AWS, Google, Oracle, Salesforce, SAP, Mulesoft, Feedzai, and SAS, among others, then you are in the right place!
Find out more at www.deloitte.com/pt/careers.
Keywords: About Deloitte; Consulting; Technology
More jobs like this
or browse Security·Mid-level·Consulting
