Which tools, certifications and techniques do DFIR employers actually ask for? Explore demand from the job postings Forensic Focus tracks every week, filtered by country and role focus.
Demand at a glance
Across 1,407 unique DFIR job postings collected 2026-05-30 to 2026-08-10 in 13 countries, the terms employers name most often are:
- Tools: EnCase (5%), FTK (5%), Cellebrite (4%), AXIOM (3%), X-Ways (3%)
- Certifications: GCFA (4%), GCIH (3%), GCFE (3%), SANS (2%), GNFA (1%)
- Techniques: threat hunting (19%), malware analysis (17%), triage (16%), reverse engineering (6%), log analysis (5%)
Percentages are the share of tracked postings mentioning each term. Use the explorer above to filter by country and role focus, and to compare tools, certifications and techniques.
More DFIR career tools
- DFIR Salary Explorer — advertised pay by country, role and seniority
- DFIR Training Finder — courses and certifications ranked by employer demand
- Practice & CTF Directory — evidence datasets, labs and challenges to build skills on
- Tool Release Tracker — latest releases across the open-source DFIR toolbox