Principal Engineer - Digital Forensics

About this role:

At Wells Fargo, a Principal Engineer defines long-term engineering solutions for highly complex business and technical needs across multiple groups or the enterprise. You will translate strategic technology opportunities into technical direction, guide resolution of unique challenges, and provide leadership with insight on significant solutions and emerging technologies.

In this role, you will:

• Advise leadership on applications, networks, information security, databases, operating systems, or web technologies for highly complex business and technical needs across multiple groups
• Lead strategy and resolution of highly complex and unique challenges requiring in-depth evaluation across multiple areas or the enterprise
• Translate advanced technology experience, business objectives, enterprise technology environments, organizational structures, and strategic opportunities into technical engineering solutions
• Provide vision, direction, and expertise to leadership on innovative and significant business solutions
• Maintain knowledge of industry practices and emerging technologies and recommend innovations that enhance operations or competitive position
• Strategically engage with professionals and managers across the enterprise and serve as a technical advisor to leadership

Required Qualifications:

• 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education

Desired Qualifications:

• 7+ years of focused professional experience in DFIR, threat hunting, and digital forensics within highly regulated industries (financial services preferred) or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education.
• Proven experience leading complex, multi‑team, enterprise‑wide programs in highly regulated organizations.
• Strong knowledge of digital forensics and incident response principles, tooling, and frameworks (e.g., case management systems, SOAR, log pipelines, forensics investigations, event triage).
• Familiarity with SOC and IR functions, threat intelligence, detection engineering, and crisis management.
• Experience with SIEM tools like Splunk , Crowdstrike etc.
• Proficiency with program and project management tools and frameworks (e.g., JIRA, Confluence, Smartsheet, MS Project, SAFe, Agile, Waterfall/Hybrid).
• Demonstrated proficiency in Python, PowerShell or equivalent scripting languages with practical experience automating forensic evidence collection, processing and investigative workflows.
• Exceptional communication skills, including executive‑level reporting, stakeholder engagement, and risk management.
• Ability to operate effectively across highly technical and non‑technical domains, balancing operational needs with engineering constraints and business priorities.
• Proven ability to analyze malware and malicious artifacts, including dynamic and static analysis, memory forensics, and identification of persistence mechanisms (formal reverse‑engineering experience is a plus).
• Demonstrated expertise in cloud incident response (AWS, Azure, or GCP), including log analysis, IAM investigations, container workload forensics, and cloud-native security tooling.

Job Expectations:

• Perform Tier 3 investigation on critical cyber cases in 24.7 environment.
• Conduct forensic analysis of cyber incidents including hacking, malware attacks, data breaches and insider threats.
• Identify, preserve, extract and analyze digital evidence from computers, mobile devices, servers, cloud systems, and other digital storage media.
• Use industry-standard forensic tools and techniques (e.g., FTK, EnCase, X-Ways, Autopsy, Volatility, Cellebrite) to uncover evidence and trace cyber attackers
• Lead and execute advanced digital forensic investigations involving endpoint, cloud, network, mobile, email, and SaaS platforms to determine root cause, impact, data exposure, and attacker methodology.
• Design, develop and maintain scalable forensic acquisition and analysis workflows, including custom scripts, artifact parsers, and automation to improve investigation efficiency and reduce manual effort.
• Serve as Incident Commander during major security events, coordinating cross‑functional technical teams, legal, compliance, risk, and executive leadership to drive timely containment and eradication actions.
• Conduct threat hunting activities leveraging SIEM, EDR, network telemetry, and intelligence sources to proactively identify indicators of compromise (IOCs), anomalous behaviors, and emerging threats targeting the financial sector.
• Develop and maintain incident response playbooks and standard operating procedures, ensuring alignment with regulatory requirements, industry frameworks, and evolving threat landscapes.
• Build and maintain forensic readiness capabilities, including logging strategy, chain‑of‑custody processes, evidence retention standards, forensic imaging workflows, and tooling optimization.
• Collaborate with Fraud, Legal, Compliance, Privacy, and internal Audit teams to support investigations involving insider threats, data misuse, fraud activity, and regulatory reporting.
• Perform malware triage and reverse‑engineering (as appropriate) to evaluate malicious payloads, persistence mechanisms, pivot paths, and risk to the institution, providing actionable intelligence to detection engineering teams.
• Drive continuous improvement of detection and response capabilities by identifying monitoring gaps, recommending new security technologies, tuning alerts, and contributing to security architecture reviews.
• Prepare high‑quality written reports and executive‑level briefs summarizing findings, incident timelines, business impact, and recommendations for remediation and long‑term risk reduction.
• Mentor and provide technical leadership to junior analysts, delivering training in forensic methodologies, investigative techniques, threat analysis, tool usage, and incident response best practices.

Posting End Date:

We Value Equal Opportunity

Wells Fargo is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other legally protected characteristic.

Employees support our focus on building strong customer relationships balanced with a strong risk mitigating and compliance-driven culture which firmly establishes those disciplines as critical to the success of our customers and company. They are accountable for execution of all applicable risk programs (Credit, Market, Financial Crimes, Operational, Regulatory Compliance), which includes effectively following and adhering to applicable Wells Fargo policies and procedures, appropriately fulfilling risk and compliance obligations, timely and effective escalation and remediation of issues, and making sound risk decisions. There is emphasis on proactive monitoring, governance, risk identification and escalation, as well as making sound risk decisions commensurate with the business unit's risk appetite and all risk and compliance program requirements.

Candidates applying to job openings posted in Canada: Applications for employment are encouraged from all qualified candidates, including women, persons with disabilities, aboriginal peoples and visible minorities. Accommodation for applicants with disabilities is available upon request in connection with the recruitment process.

Applicants with Disabilities

To request a medical accommodation during the application or interview process, visit.

Drug and Alcohol Policy

Wells Fargo maintains a drug free workplace. Please see our to learn more.

Wells Fargo Recruitment and Hiring Requirements:

a. Third-Party recordings are prohibited unless authorized by Wells Fargo.

b. Wells Fargo requires you to directly represent your own experiences during the recruiting and hiring process.

c. Please be prepared to provide accurate information and supporting documentation in connection with any lawful employment and education verification conducted by Wells Fargo.