20 tasks, each one witnessed by the sources that watched the job — and behind every one, a prompt you can use tonight.
You start by triaging new incidents: check alerts from AWS logs, SIEM, or the incident queue, then collect volatile data (RAM, running processes) from affected hosts. That often means using scripts to pull memory images, process lists, and network connections right away because volatile data disappears when machines reboot.
Afternoon is analysis: file signature checks, malware reverse engineering (often using C++ or Go samples), log timeline building, and writing findings into the incident ticket. You spend time preserving evidence and updating chain-of-custody records so the data remains court-ready if needed.
Expect hands-on with macOS and Linux hosts, cloud trails in Amazon Web Services (AWS), and Google Workspace logs for email and docs. You'll also see network protocols like BGP when investigating routing attacks or traffic anomalies.
You’ll write Bash, Python, or Go scripts and use config tools like Ansible to automate collection. For malware you may read C++ binaries or disassemble code to find indicators. File signature analysis and hash checks are daily tasks.
The U.S. Bureau of Labor Statistics (BLS) reports 435,370 employed in the larger SOC-15-1299.06 area, with a median annual wage of $116,580. The lowest tenth earn about $55,940 and the top tenth about $188,470, per BLS 2025 data.
Pay varies by sector: government roles often start lower but offer stability and training; private industry or specialized incident response firms usually pay more, especially for cloud or malware expertise.
Use AI for triage and pattern spotting only: summarize logs, extract IOC candidates, or suggest query expansions. Never feed raw evidence or personally identifiable information into third‑party AI services without a vetted, enterprise instance or legal approval.
Keep a reproducible chain: document every AI prompt, the AI model used, and the files given. Treat AI output as an assistant to speed tasks, not as a final forensic conclusion—always verify with concrete tests like file signature checks or controlled malware runs in isolated sandboxes.
Begin with the basics: learn Bash for scripting, get comfortable with macOS and Linux command line, and study file systems and file signatures. Practice collecting volatile data and imaging drives with free tools; build a home lab with a VM for malware practice.
Then study AWS logging (CloudTrail), Google Workspace audit logs, and basic networking (TCP/IP, BGP fundamentals). Take courses or certifications in incident response and digital forensics, and write small automation scripts to parse large logs—those are skills employers ask for.
Forensics analysts focus on preserving and proving what happened after an incident—imaging disks, maintaining chain of custody, and preparing evidence for legal use. They do deep artifact recovery, file signature analysis, and malware reverse engineering.
Cybersecurity analysts monitor and prevent attacks (rules, SOC alerts); threat hunters proactively search for unknown intrusions across networks. There’s overlap: forensics people support incident response and threat hunting by extracting definitive evidence and detailed timelines.
Practical skills that matter day one: disk imaging and hash verification, volatile data collection, file signature analysis, and writing Bash or Go scripts to parse large log files. Experience with AWS CloudTrail and Google Workspace audit logs is highly valuable.
Also know how to document chain of custody, run controlled malware analysis, and read C++ binaries or configuration files for clues. Familiarity with automation tools like Ansible to standardize collection across many hosts is a strong plus.