Supervisor in Cyber Forensic and Response at KPMG South Africa

• We are currently looking for a Supervisor in Cyber Forensic and Response within our Forensic Business unit in Johannesburg

Job Purpose

• Collect, preserve, and analyze digital evidence to determine root cause and scope of compromise.

Responsibilities

• Perform forensic imaging and evidence preservation.
• Analyze disks, memory dumps, logs, and network captures.
• Reconstruct attack timelines and identify indicators of compromise (IOCs).
• Support law enforcement or legal teams with admissible evidence.
• Oversee storage, access control, and security of digital evidence repositories.
• Support investigators with data extractions, large-scale queries, and log analysis.
• Automate ingestion, parsing, and correlation of diverse data sources (network, endpoint, cloud, and application).
• Manage system integrations between forensic platforms, SOAR, and incident response tools.
• Ensure regular patching, backup, and system health monitoring of forensic environments.
• Maintain chain-of-custody controls and documentation within digital evidence systems.
• Evaluate and onboard new forensic or analytics tools to enhance investigative efficiency.
• Administer and maintain all forensic and investigation platforms
• Maintain chain-of-custody controls and audit trails across Azure data and evidence repositories.

Qualifications and skills

• Education: Degree in Digital Forensics, Cybersecurity, or IT.
• Certifications: GCFA, CHFI, EnCE, or CCE or related ones
• Experience: 3–7 years in digital forensics or law enforcement investigations.
• Skills: EnCase, FTK, X-Ways, Volatility, Autopsy, log and packet analysis.
• Strong command of forensic and data platforms (EnCase Enterprise, Magnet AXIOM, Nuix, Relativity, X-Ways, FTK)
• Optional: relevant cloud forensic certifications, Azure/AWS SysOps, or Database Administrator certifications