At SITA, we keep airports moving, airlines flying smoothly, and borders open. Our technology and communication innovations power the success of the global air travel industry. You'll find us in 95% of international airports, working closely with over 2,500 transportation and government clients. Each partnership brings unique challenges, and we thrive on delivering fresh solutions and cutting-edge tech to keep operations running like clockwork. We don't just move the world forward-we're proud to be recognized as a Great Place to Work by 79% of our employees and certified in most of our growing locations. Here, we feel empowered, supported, and inspired to grow. Are you ready to love your job? The adventure begins right here, with you, at SITA.

ABOUT THE ROLE & TEAM As the Digital Forensics & Incident Response (DFIR) Lead, you will be responsible for leading SITA's most critical cybersecurity investigations, taking ownership of high-severity incidents from initial detection through containment, eradication, recovery, and post-incident review. You will serve as the Incident Commander during major cyber events and act as the senior technical escalation point for complex investigations, digital forensics activities, and insider threat cases. As a key member of SITA's Enterprise Information Security Office (EISO) and part of the CSIRT Response Team, you will collaborate closely with Security Operations, CSIRT Threat, Cloud & Infrastructure, Product Security, Corporate IT, and customer-facing teams to strengthen SITA's detection, investigation, and incident response capabilities. Your work will help enhance cyber resilience across SITA, its customers, and the broader air transport ecosystem. This role combines deep technical expertise, operational leadership, and strategic influence to continuously improve incident response maturity, forensic readiness, investigative capabilities, and security operations effectiveness across the organization.

WHAT YOU WILL DO

Incident Response & Coordination

• Lead the response to high-severity and business-critical cybersecurity incidents across the full incident response lifecycle, including detection, containment, eradication, recovery, and post-incident improvement.
• Serve as Incident Commander, directing cross-functional response teams and coordinating activities across SOC, CSIRT Threat, Corporate IT, Cloud & Infrastructure, Product Engineering, Legal, Compliance, and Business stakeholders.
• Drive rapid decision-making during active incidents, ensuring effective communication, stakeholder alignment, and business impact mitigation.
• Deliver comprehensive incident reports, executive-level briefings, and post-incident reviews with clear recommendations and remediation plans.
• Develop, maintain, and continuously improve incident response process, playbooks, runbooks, and response procedures based on emerging threats and lessons learned.
• Lead tabletop exercises, simulations, and cyber crisis response activities to enhance organizational preparedness.

Digital Forensics & Evidence Handling

• Conduct forensically sound acquisition, preservation, analysis, and reporting of evidence across endpoints, servers, cloud environments, networks, SaaS platforms, and enterprise applications.
• Ensure evidence handling, chain-of-custody processes, and investigative documentation meet legal, regulatory, and industry best-practice standards.
• Reconstruct attacker timelines, determine root cause, assess impact, and map adversary behaviours to the MITRE ATT&CK framework.
• Perform advanced investigations involving malware, ransomware, data exfiltration, account compromise, insider activity, and sophisticated persistent threats.

Insider Threat & Risk

• Lead investigations involving insider threats, including unauthorized access, misuse of privileged accounts, intellectual property theft, data loss, fraud, and policy violations.
• Partner with HR, Legal, Compliance, and Regulatory teams to support sensitive investigations through forensic analysis, technical expertise, and defensible evidence collection.
• Assess insider threat risks and recommend preventive, detective, and corrective controls to strengthen organizational security posture.
• Contribute to the development of insider threat monitoring capabilities, governance frameworks, and risk mitigation strategies.

Tooling, Automation & Telemetry

• Design and implement automation, scripts, and workflows to accelerate evidence collection, enrichment, triage, forensic analysis, and incident response activities.
• Leverage AI-driven analytics, machine learning, and automation capabilities to enhance threat detection, investigative efficiency, and response effectiveness across security platforms.
• Partner with platform owners and engineering teams to improve security telemetry, logging coverage, retention, and forensic visibility across on-premises, cloud, and hybrid environments.

Desired Candidate Profile

Proven experience leading digital forensics and incident response investigations in large, complex enterprise environments, ideally within critical infrastructure, transportation, aviation, or other regulated industries.

Strong hands-on experience with EDR/XDR, SIEM, SOAR, and forensic investigation tools, with the ability to lead complex investigations from initial detection through remediation.

Experience conducting forensically sound evidence collection and analysis across endpoints, servers, cloud platforms, networks, identity systems, and SaaS environments.

Proficiency in Python and/or PowerShell scripting and automation, with working knowledge of KQL and security analytics.

Strong understanding of cyber adversary tactics, techniques, and procedures (TTPs), including practical application of the MITRE ATT&CK framework.

Excellent analytical, communication, and stakeholder management skills, with the ability to lead teams and provide clear briefings to both technical and executive audiences.

Nice-to-Have:

• Relevant Certifications such as GCFA, GNFA, GCIH, GREM, GCFE, CISSP, or OSCP.
• Experience leading cloud forensic and incident response investigations across Azure, AWS, and/or Google Cloud Platform (GCP).
• Experience with forensic frameworks and tools such as FTK, EnCase, Velociraptor, KAPE, Autopsy, or Volatility.
• Familiarity with regulatory, legal, and compliance requirements related to digital investigations, evidence handling, and incident reporting.
• Experience supporting cybersecurity operations within aviation, airport, transportation, operational technology (OT), or critical infrastructure environments.
• Experience leveraging automation, orchestration, and AI-enabled capabilities to enhance incident response and forensic investigation effectiveness.