Forensic Analysts

Blue-team specialists who investigate compromised systems in depth, collecting and analyzing evidence, disk, memory, logs, to reconstruct what an attacker did. They provide the deep analysis that supports incident response and lessons learned.