🔍 Digital Forensics & Incident Response
Cybersecurity career path
Investigate breaches, recover evidence and lead response to major incidents.
Typical roles
- DFIR Analyst
- Incident Responder
- Forensic Examiner
Suggested certifications, by phase
Foundation
Core
- GCIH GIAC Certified Incident Handler
- GCFE GIAC Certified Forensic Examiner
- BTL1 Centri Blue Team Level 1
- HTB CDSA Hack the Box Certified Defensive Security Analyst
Advanced
- GCFA GIAC Certified Forensic Analyst
- GNFA GIAC Network Forensic Analyst
- EnCE OpenText EnCase Certified Examiner
- BTL2 Centri Blue Team Level 2
Mastery
- GREM GIAC Reverse Engineering Malware
- CFCE IACIS Certified Forensic Computer Examiner
- CAWFE IACIS Certified Advanced Windows Forensic Examiner
A suggestion, not a set of prerequisites — one or two certifications per phase is plenty.