AI Response CIRT, Technical Member (26-00717) -

About the role

World Wide Technology is hiring for a large financial services client. You will be the hands on technical investigator for a team that responds to incidents involving AI systems. You dig into logs and activity from AI platforms, integrations, and agents to work out what happened and what data was exposed.

What you will do

• Analyze logs and activity from AI platforms, integrations, and agents
• Determine what happened and what data was exposed
• Collect and preserve evidence
• Recommend containment steps
• Support the AI response coordinator with clear technical findings

What you bring

• 8+ years of hands on digital forensics and incident response
• Log analysis and evidence collection in cloud and SaaS environments, such as Microsoft 365, Azure, AWS, and Google
• Ability to reconstruct events and show what data was exposed
• Recent work investigating AI platforms, agents, or integrations, including API and audit logs and OAuth app grants

Nice to have

• Splunk, CrowdStrike, Sentinel, and Wiz
• Python scripting
• Knowledge of LLM and agent architectures, prompt injection, and data exposure patterns

Preferred certifications

GCFA, GCFE, GCIH, GCED, and cloud security certifications

Technology and frameworks

Microsoft 365, Azure, AWS, and Google cloud and SaaS logging, API and audit logs, OAuth app grants, Splunk, CrowdStrike, Microsoft Sentinel, Wiz, and Python.

Background we look for

This is a technical, individual contributor role. AI specific investigation experience is still emerging across the industry, so we look for deep DFIR skills plus recent, demonstrable work on AI platforms or integrations. A large regulated enterprise background is preferred.