Security
Digital Forensics
Also written as DFIR, Forensic Investigation, Chain of Custody
Reconstructing what happened after a breach from logs, disks and memory, in a way that holds up afterwards for lawyers, regulators and insurers.
Think of it like
Crime scene work. What you touch, and in what order, matters as much as what you find.
Junior or senior?
Rarer and more specialised than general incident response.
Senior sounds like
Knows evidence handling, and that rebuilding a machine too early destroys the answer.
Ask them
“What did you preserve before you started cleaning up, and why that?”