Astrid Bergman Incident Response Engineer
New York, NY • dfir@gmail.com • +1 212-555-0148
Profile Summary
- Incident Response Engineer with 10 years of experience leading DFIR for MSSP and consultancy engagements across financial services, retail, and healthcare clients, specializing in end-to-end incident response, host and memory forensics, and cloud IR.
- Solid technical background across EDR (CrowdStrike Falcon, SentinelOne), SIEM (Splunk), forensic acquisition (Magnet AXIOM, KAPE), memory (Volatility), network (Zeek), sandboxing (ANY.RUN), cloud IR (AWS CloudTrail and M365 / Okta), and MITRE ATT&CK-driven hunting, with strong fundamentals in chain-of-custody rigor, hypothesis-driven hunting, and blameless postmortems on every case.
- Deep expertise in end-to-end incident response leadership, host, memory, and network forensics, cloud and SaaS incident response, and malware analysis and threat hunting, applying practices such as MITRE ATT&CK-aligned hunting and SANS PICERL playbook discipline to deliver fast, defensible, and well-documented incident outcomes.
- Engaged collaborator working cross-functionally with Security Operations, IT, Legal, Comms, and executive leadership in high-tempo enterprise IR programs, contributing to crisis war rooms, executive briefings, and blameless post-incident reviews with a pragmatic, ownership-first mindset.
- Senior practitioner who shares technical excellence and fosters a culture of chain-of-custody discipline and blameless postmortem rigor through playbook authorship and case-leadership coaching, while running DFIR practice working group sessions and authoring widely adopted IR runbook and tabletop templates.
Technical Skills
- IR Leadership & Frameworks:
- SANS PICERL, NIST 800-61, MITRE ATT&CK, executive briefings, war-room leadership, IR playbooks, tabletop exercises
- Forensic Acquisition:
- Magnet AXIOM, FTK, EnCase, X-Ways, Velociraptor, KAPE, dd, write-blockers, evidentiary integrity
- Host & Endpoint Forensics:
- Windows (event logs, registry, prefetch, shimcache, AmCache, $MFT), macOS (FSEvents, Unified Logs), Linux (syslog, bash history, audit)
- Memory Forensics:
- Volatility, Rekall, MemProcFS, injected-code detection, credential theft analysis, C2 reconstruction, fileless malware
- Network Forensics:
- Wireshark, Zeek / Bro, Suricata, Arkime, NetFlow analysis, DNS / proxy / firewall logs, JA3 fingerprinting
- Cloud & SaaS IR:
- AWS CloudTrail, Azure Activity Logs, GCP Audit Logs, M365 UAL, Google Workspace, Okta, GitHub Audit, token-abuse analysis
- Malware Analysis:
- IDA Pro, Ghidra, x64dbg, ANY.RUN, Joe Sandbox, Cuckoo, static + dynamic analysis, IOC + YARA extraction
- Threat Hunting & Reporting:
- Hypothesis-driven hunting, EDR + SIEM hunts, executive briefings, technical IR reports, root-cause analysis, postmortems
Education
Rochester Institute of Technology
M.S. in Computing Security (DFIR concentration)
Work Experience
Stroz Friedberg (Aon)
Senior Incident Response Engineer
- Lead incident response for Stroz Friedberg's enterprise IR practice across 40+ incidents per year, coordinating war-room coordination, forensic acquisition strategy, and executive briefing cadence with 6 IR consultants across 22 client engagements.
- Performed forensic acquisition on Magnet AXIOM and Velociraptor, executing 180+ host and cloud acquisitions with strict chain-of-custody, sustaining zero evidentiary challenges across 3 litigation-supported cases.
- Analyzed host artifacts across Windows, macOS, and Linux including event logs, registry, prefetch, AmCache, and $MFT, reconstructed full intrusion timelines on 24 cases with mapped persistence, lateral movement, and exfiltration paths.
- Acquired and analyzed volatile memory with Volatility and Rekall on 60+ memory captures, surfaced fileless malware on 9 hosts that disk forensics missed and reconstructed 4 active C2 sessions.
- Ran network forensics with Zeek and Arkime across 12 TB of PCAP and NetFlow, identified 7 active C2 channels and 3 exfil paths including DNS tunneling and proxy-evading TLS patterns.
- Investigated incidents across AWS CloudTrail and M365 Unified Audit Log on 14 cloud-centric IR cases, traced token-abuse and privilege-escalation paths end-to-end across federated identity boundaries.
- Performed static and dynamic malware analysis in ANY.RUN and Ghidra on ~90 samples per year, extracting IOCs and TTPs that cut median dwell time across engagements from 38 days to 9 days.
Secureworks
Incident Response Engineer
- Designed and executed containment and recovery via network isolation + credential rotation across 1,200 hosts and 38 identities on the largest engagement of the year, with zero re-compromise across 60-day verification window.
- Owned the threat-hunting practice on MITRE ATT&CK across EDR and SIEM, running 42 hypothesis-driven hunts and surfaced 6 dwell-time intrusions that bypassed detection.
- Authored executive briefings and technical IR reports across the team's case portfolio, shipping 80+ reports authored and rebuilt the team's playbook library and ran 9 tabletop exercises.
- Partnered with Legal, Comms, IT, and Threat Intel teams across 18 client engagements per year, authoring 22 IR runbooks and onboarding 4 new IR consultants into the team's acquisition and reporting workflow.