Digital Forensic Investigator

One of the world’s largest financial services companies is seeking a Digital Forensics Investigator to join its cybersecurity organization. As a highly specialized technical professional in Japan, the Digital Forensics Investigator will be responsible for the analysis and response activities related to digital forensics and incident response (DFIR). You will conduct investigations following security incidents, support threat hunting activities, and contribute to the development and enhancement of the organization’s incident response capabilities, as well as other cybersecurity-related activities as required, within a global and rapidly evolving corporate environment.This role requires the ability to assess situations and data from multiple perspectives and solve highly complex problems, including those involving factors that may not have clearly defined metrics or objective decision criteria. We are looking for someone who can work effectively in an agile environment, apply sound business judgment, embrace diversity and different perspectives, and demonstrate a strong commitment to continuous learning.

Responsibilities
- Partner with cross-functional stakeholders, including group life insurance companies, the Information Security Office (ISO), and global technology teams, to support and coordinate cyber incident response activities on a global scale
- Conduct complex, enterprise-scale investigations across hybrid environments, including on-premises and cloud environments such as Active Directory / Entra ID, Microsoft 365, Azure, and AWS
- Leverage SIEM and detection platforms to conduct efficient, data-driven investigations using advanced query techniques, including Splunk Search Processing Language (SPL) and Microsoft Kusto Query Language (KQL)
- Utilize Endpoint Detection & Response (EDR) technologies to perform large-scale endpoint investigations, threat hunting, triage, and root cause analysis (RCA) across distributed environments
- Perform comprehensive digital forensic analysis across multiple domains, including log analysis, host-based forensics, memory analysis, and network traffic analysis, to support incident response activities
- Conduct triage and analysis of malicious code to identify indicators of compromise (IOCs), behavioral patterns, and potential impact, contributing to containment and recovery strategies
- Organize and communicate investigation findings in a clear, concise, and actionable manner, including the preparation of high-quality investigation reports and verbal briefings for both technical professionals and senior business leaders
- Develop and maintain scripts, detection queries, and automated workflows using tools such as XSOAR to improve the efficiency, consistency, and scalability of incident response activities
- Lead or actively contribute to strategic initiatives and continuous improvement activities aimed at strengthening forensic, detection, and incident response capabilities across the enterprise

Required Skills:
- 5+ years of hands-on experience in cyber incident response and digital forensics within large and complex enterprise environments, including experience working in global organizations or geographically distributed environments
- Ability to clearly explain complex technical concepts, investigation findings, and risk implications in both Japanese and English to technical teams as well as business stakeholders, including non-technical audiences
- Hands-on experience with digital forensics tools such as X-Ways and EnCase, including either commercial or open-source tools
- Foundational to practical-level knowledge and experience in scripting and automation using Python, PowerShell, Bash, or similar technologies, including experience improving investigation efficiency, performing data analysis, or automating response activities
- Strong understanding of attacker behaviors and Tactics, Techniques, and Procedures (TTPs), with practical experience applying frameworks such as MITRE ATT&CK and the Lockheed Martin Cyber Kill Chain to detection, investigation, and incident response activities

Why should you apply:
- Join a team and culture where your perspectives are valued and where your work can make a meaningful difference to people's experiences and everyday lives.
- Build on your existing expertise while gaining opportunities to strengthen both your technical and leadership capabilities. We support continuous learning so that you can create an even greater impact.
- Discover the career possibilities offered by a strong and well-established organization while working on meaningful cybersecurity challenges and initiatives.


Company Details:
Founded in 2008 and headquartered in the United States, the company is one of the world’s largest financial services institutions. As a global organization, it actively collaborates with international partners while providing IT infrastructure services to group companies across Japan.
Guided by the strong commitment of the Group to protect customers’ financial security and peace of mind, the company serves as a trusted partner supporting both technology and business. Its mission is to continue delivering stable, reliable, and trusted system infrastructure services.

Working Hours: 9:00 – 18:00
Work Style: Hybrid (1–2 days per week in the office; 0–2 weekend workdays per month)
Holidays: Saturdays, Sundays, public holidays, year-end and New Year holidays, paid leave, and special leave
Benefits: Full social insurance coverage, DC pension plan, transportation allowance, Skill House University, test payback system, and more