About the Company
Interactive Brokers Group, Inc. (NASDAQ: IBKR), a member of the S&P 500, is a global financial services company headquartered in Greenwich, Connecticut, with offices in over 15 countries. Through its affiliates, Interactive Brokers provides automated trade execution and custody of securities, commodities, foreign exchange, and prediction markets on over 170 markets in numerous countries and currencies.
For more than four decades, Interactive Brokers has focused on technology, automation, and innovation to provide clients worldwide with a sophisticated, unified platform to manage their investment portfolios. We serve individual investors, hedge funds, proprietary trading groups, financial advisors, and introducing brokers.
Our culture is driven by problem-solving, efficiency, and continuous improvement. We look for individuals who are intellectually curious, collaborative, and motivated to contribute to technology that helps simplify and enhance access to global financial markets. Interactive Brokers has consistently been recognized as a top broker by respected industry sources including Barron’s, Investopedia, Stockbrokers.com, and others.
Position Overview:
We are seeking an experienced Digital Forensics & IR Analyst to join our Cyber Defense capability, with a primary focus on Digital Forensics and Incident Response (DFIR). This role is responsible for conducting in-depth forensic investigations, evidence preservation, attack reconstruction, and root cause analysis, while supporting the SOC and Incident Response teams during complex and high severity incidents.
Key Responsibilities:
Digital Forensics & Investigations
- Run and execute forensic investigations involving endpoints, servers, network traffic, cloud platforms, and authentication systems
- Perform forensic data acquisition and preservation, ensuring proper chain-of-custody and evidentiary integrity
- Conduct timeline reconstruction, artifact analysis, and attack path analysis to determine scope, impact, and root cause
- Analyze disk, memory, logs, and security telemetry to identify attacker techniques and dwell time
- Support post incident‑ root cause analysis (RCA) and contribute to long term remediation recommendations
Incident Response & SOC Operations
- Support incident response activities for security events including malware, phishing, endpoint compromise, suspicious access, and network based‑ attacks
- Perform alert triage and investigation using SIEM and EDR platforms, escalating complex cases to senior IR or DFIR personnel
- Execute incident response playbooks during active incidents, following defined investigation and escalation procedures
- Perform deep dive log analysis across Windows, Linux, network, and cloud environments
- Validate and enrich Indicators of Compromise (IOCs) using internal tools and threat intelligence sources
- Correlate activity across SIEM, EDR, network, and authentication logs to identify scope and impact
Documentation & Reporting
- Produce high quality forensic reports, investigation summaries, and executive level-incident documentation
- Ensure investigations meet internal, regulatory, and audit requirements
- Support legal, compliance, and regulatory teams by providing defensible forensic evidence when required
- Maintain accurate incident and investigation documentation within the incident management system
- Assist in preparing incident reports, forensic summaries, and lessons learned documentation
- Ensure investigations meet internal quality, audit, and compliance expectations
Learning & Collaboration
- Work closely with SOC analysts, Incident Responders, and senior DFIR engineers
- Continuously build DFIR skills through hands-on investigations and training.
- Stay current with attacker techniques, forensic methods, and SOC best practices
Required Skills & Experience
- 2+ years of hands-on experience in DFIR, Incident Response, and Security Investigations
- Strong experience with Host, memory and network-based forensics.
- Proficiency with SIEM and EDR platforms for investigation and correlation
- Solid understanding of Windows, Linux, and networking.
- Experience handling complex and high severity security incidents
- Strong analytical and documentation skills with attention to evidentiary detail
Preferred Qualifications
- Hands-on experience with forensic tooling (disk, memory, log, or network analysis tools)
- Forensics Tools: Encase, FTK, X-Ways, Autopsy, Magnet Axiom, Nuix, Cellebrite etc.
- Malware Analysis Tools: DA Pro, Yara, volatility, Ghidra, etc.
- Familiarity with legal hold, eDiscovery, and regulatory response workflows
- Relevant certifications: GCFE, GCED, GCIH, GCIA, GNFA
Key Competencies
- Analytical thinking: Ability to perform root cause analysis (RCA).
- Communication: Ability to communicate technical risks to stakeholders.
- Collaboration: Working with IT teams to improve security posture.
Technical Environment:
- SIEM platforms
- EDR solutions
- Network monitoring tools
- Incident management systems
Work Requirements:
- Willingness to work outside of standard working hours.
- Incident response handling
- Alert triage and escalation
- Documentation and reporting
- Team collaboration
Growth Path:
- Advanced IR certification support
- Threat hunting training
- Technical skill development
- Senior analyst progression
Company Benefits & Perks:
- Competitive salary package.
- Performance based annual bonus (cash and stocks).
- Hybrid working model (3 days office/week).
- Group Medical & Life Insurance.
- Modern offices with free amenities & fully stocked cafeterias.
- Monthly food card & company paid snacks.
- Hardship/shift allowance with company provided pickup & drop facility*
- Attractive employee referral bonus.
- Frequent company sponsored team building events and outings.
* Depending upon the shifts.
**The benefits package is subject to change at the management's discretion.