Manager, Digital Forensics Investigator

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.

Position Summary

As a Principal Digital Forensics Investigator within Cyber Defense at Optum Insight, you will serve as the senior technical expert responsible for establishing, maturing, and leading the enterprise digital forensics capability. This role provides advanced forensic expertise in support of cybersecurity incident response, cyber threat intelligence, internal investigations, security investigations, insider-risk matters, and other high-priority events across the organization. You will lead complex forensic investigations across endpoint, network, cloud, identity, application, mobile, and enterprise technology environments; ensure evidence is collected, preserved, analyzed, documented, and handled with forensic integrity; and translate findings into defensible conclusions, containment guidance, detection opportunities, and security improvements. This position partners closely with Security Operations, Incident Response, Data Protection & Insider Risk, Cyber Threat Intelligence, Legal, Privacy, Human Resources, Compliance, and other stakeholders to deliver timely, technically rigorous, and business-aligned investigative outcomes.

This role will provide a hybrid schedule

Primary Responsibilities:

• Establish, mature, and lead the Digital Forensics and Investigations capability within Cyber Defense, including forensic readiness, operating procedures, evidence-handling standards, investigative workflows, playbooks, documentation templates, and quality assurance practices
• Lead complex digital forensic investigations involving suspected compromise, malware activity, unauthorized access, insider activity, data loss, policy violations, identity misuse, cloud compromise, and other security events requiring defensible digital evidence
• Provide advanced forensic expertise throughout the incident response lifecycle, supporting scoping, containment, eradication, recovery, root-cause analysis, impact assessment, attacker activity reconstruction, and post-incident improvement efforts
• Conduct forensic examinations across Windows, Linux, macOS, mobile devices, network infrastructure, cloud platforms, SaaS environments, identity systems, applications, servers, virtual machines, containers, and other enterprise technology assets
• Perform analysis of disk images, memory, file systems, event logs, network traffic, packet captures, DNS, proxy, firewall, VPN, IDS/IPS, authentication events, browser artifacts, application data, deleted files, persistence mechanisms, and other sources of digital evidence
• Develop and execute secure remote evidence collection and preservation processes across distributed environments, including forensic imaging, memory acquisition, log collection, targeted file acquisition, cloud evidence collection, mobile evidence acquisition, hashing, chain of custody, and secure evidence storage
• Reconstruct timelines and correlate forensic evidence across endpoint, network, cloud, identity, and application telemetry to determine root cause, identify affected assets and accounts, establish attacker or user activity, and support investigative conclusions
• Support authorized internal investigations involving suspected misuse of technology, unauthorized access, data loss, policy violations, insider activity, and other matters requiring digital evidence, while maintaining confidentiality, privacy requirements, and evidence integrity
• Partner with Cyber Threat Intelligence and Incident Response teams to translate forensic findings into indicators, adversary behaviors, detection logic, hunting hypotheses, security control improvements, and lessons learned
• Identify forensic telemetry, tooling, process, and data source gaps; recommend improvements; and develop automation or repeatable workflows for triage, evidence collection, analysis, preservation, and reporting
• Evaluate, recommend, and operationalize forensic tools, technologies, collection methods, and investigative capabilities across endpoint, network, cloud, identity, and mobile environments
• Serve as the senior forensic escalation point and trusted technical authority for complex investigations, providing mentorship, investigative standards, peer review, and technical guidance to Cyber Defense teams
• Prepare clear, technically defensible investigative reports, executive summaries, evidence narratives, timelines, risk implications, and recommended actions for technical teams, senior leadership, Legal, Privacy, HR, Compliance, and other authorized stakeholders
• Use enterprise-approved automation and AI-enabled capabilities, where appropriate, to improve forensic triage, evidence processing, analysis consistency, reporting efficiency, and continuous improvement
• Comply with all applicable Company policies, procedures, and business directives, including any changes relating to work location, team assignments, work schedules, and flexible work arrangements

Required Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Technology, Criminal Justice, or a related field, or equivalent professional experience
• 8+ years of experience in cybersecurity, digital forensics, incident response, security investigations, or a closely related technical security discipline
• Demonstrated experience independently leading complex digital forensic investigations from evidence identification and collection through analysis, documentation, final findings, and stakeholder communication
• Solid hands-on experience with endpoint, network, cloud, identity, and mobile forensic investigations in enterprise environments
• Experience developing or improving forensic processes, investigative workflows, evidence-handling procedures, chain-of-custody practices, forensic readiness capabilities, or related operational standards
• Experience with remote evidence collection and preservation, including forensic imaging, memory acquisition, log collection, targeted file collection, cloud evidence collection, hashing, evidence validation, and secure storage
• Experience analyzing Windows and Linux environments; macOS experience Solidly preferred
• Experience investigating cloud platforms, SaaS environments, identity systems, virtual infrastructure, containers, or cloud-hosted workloads
• Solid understanding of forensic methodologies, evidence integrity, investigative documentation, root-cause analysis, attack reconstruction, and timeline development
• Solid understanding of networking, authentication, identity and access management, operating systems, file systems, endpoint detection and response, SIEM telemetry, network security, and enterprise security architecture
• Demonstrated ability to partner effectively with Incident Response, Cyber Threat Intelligence, Legal, Privacy, HR, Compliance, and other stakeholders
• Proven excellent written and verbal communication skills, with the ability to translate highly technical forensic findings into clear, actionable conclusions for technical and non-technical audiences

Preferred Qualifications:

• Professional digital forensics, incident response, or network forensics certifications such as GCFE, GCFA, GNFA, GCIH, EnCE, CFCE, CHFI, or equivalent
• Experience establishing, scaling, or maturing an enterprise digital forensics, incident response, insider-risk, or technical investigations program
• Experience supporting legal, HR, privacy, compliance, regulatory, eDiscovery, insider-risk, or employee investigations involving digital evidence
• Experience with enterprise forensic, EDR, SIEM, SOAR, network security, cloud security, identity, data protection, and evidence management platforms
• Experience with scripting or automation using Python, PowerShell, Bash, APIs, SOAR workflows, or other methods to support evidence collection, forensic triage, analysis, and reporting
• Experience conducting or supporting malware, intrusion, data exfiltration, business email compromise, cloud compromise, privileged account misuse, or insider-threat investigations
• Experience developing executive-level investigative summaries, defensible reports, evidence narratives, timelines, and recommendations for senior leadership and cross-functional stakeholders
• Experience in healthcare or another highly regulated industry
• Hands-on experience using enterprise-approved AI-assisted or automation-enabled tools to improve forensic triage, log analysis, evidence processing, or investigative efficiency

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone-of every race, gender, sexuality, age, location and income-deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.

Optum is a drug-free workplace. © 2026 Optum Global Solutions (Philippines) Inc. All rights reserved.