Senior Digital Forensics Investigator - Global Security Organization

Description

The mission of TikTok's Global Security Organization is to build and earn trust by reducing risk and securing our businesses and products. Also known as "GSO", this team is the foundation of our efforts to keep TikTok safe, secure, and operating at scale for over 1 billion people around the world. We work to ensure that the TikTok platform is safe and secure, that our users' experience and their data remains safe from external or internal threats, and that we comply with global regulations wherever TikTok operates.

Trust is one of TikTok's biggest initiatives, and security is integral to our success. In whatever ways users interact with us — whether they're watching videos on their For You page, interacting with a Live video, or buying products on TikTok Shop — GSO protects their data and privacy, so they can have a secure and trustworthy experience.

TikTok’s Global Digital Forensics team is responsible for the company’s technical investigations and digital forensics work. We are seeking a Senior Digital Forensics Investigator. This role focuses on technical threat investigations by correlating and analyzing multi-source logs and data to build reviewable evidence chains and fact-based narratives, producing audit-ready and reproducible investigation conclusions and supporting materials.

Responsibilities
- Lead end-to-end investigations of suspected threat activity covering scoping, planning, triage, evidence collection and preservation, analysis, documentation of findings, and remediation recommendations.
- Investigate both insider threats with user behavior analysis and external threats with root cause analysis to determine intent, vector, scope, and affected assets.
- Acquire and preserve network, host, mobile, and cloud evidence using forensically sound techniques to support legal or disciplinary processes.
- Perform host-based forensic analysis of Windows, macOS, and Linux devices as well as iOS and Android mobile devices.
- Acquire and analyze cloud artifacts from Azure, AWS, Google Cloud and internal platforms.
- Analyze telemetry across EDR/HIDS, DLP, firewall/proxy/VPN/DNS/flow logs, and internal platform logs to identify staging, access, exfiltration, or misuse patterns.
- Correlate data across sources to build timelines, entity relationships, and causality chains that support findings.
- Produce technical findings that stand up to scrutiny.
- Produce and communicate executive-level findings and recommended actions to non-technical stakeholders such as Legal, Compliance, HR, and senior leadership.
- Drive proactive threat discovery and hunting by mining telemetry to surface suspicious behaviors and emerging patterns.
- Propose and refine detection rules, monitoring use cases, and investigation playbooks based on lessons learned during investigations.
- Maintain forensic lab equipment, imaging tools, and evidence storage procedures.
- Develop and maintain automation and scripts to speed evidence processing, parsing, and reporting.
- Coordinate large-scale or cross-functional forensic efforts and manage external vendors as needed.
- Mentor and train junior analysts and contribute metrics and post-incident reviews to improve response maturity.

Requirements

Minimum Qualifications
- Minimum 7 years of experience in Digital Forensics, threat investigations, or equivalent security investigation roles using forensically sound methods to acquire, preserve and analyse digital evidence.
- Strong hands-on investigation experience across at least 2 of the following domains: endpoint systems (Windows, macOS, Linux), network telemetry, cloud environments, identity systems, and business-critical internal applications and operational platforms.
- Demonstrated practical experience with EDR or HIDS telemetry, including analysis of process execution, persistence, file activity, authentication events, network connections, and other endpoint forensic artifacts.
- Strong knowledge and experience in using query languages (SPL, KQL, or SQL) to query, pivot, correlate, and analyse large datasets.
- Proven experience in using Python, jq, SQL, or similar technologies to automate data collection, enrichment, and correlation relating to investigation workflows or forensic analysis.

Preferred Qualifications
- Knowledge and exposure to mobile forensics and cloud platform acquisition and analysis.
- Experience supporting audits or evidence requests in regulated environments and/or for legal or disciplinary processes.
- Familiarity with AI-assisted investigation tools for triage, log summarisation, report drafting, and automation.
- Relevant Security certifications (GIME, GCFE, GCFA, EnCE, or similar).