Cloud-Native Forensic Readiness Leader — Genomics Discovery

The mandate

A compromised research service exposed genomic metadata, but investigators could not reconstruct container workload identity, short-lived administrator activity or object access because relevant cloud logs had expired or were stored inside the affected accounts. The response director resigned after counsel received conflicting timelines. Research leaders now need one executive to restore evidential confidence without freezing legitimate high-volume analysis.

The interim must start within two weeks for a fixed eight-month term, spending three days in Boston, two remotely and joining the stated Cambridge and San Diego reviews. The first six weeks carry direct authority over preservation and investigation standards. Permanent recruitment begins after the first readiness exercise in month four, followed by a four-week transfer; the contract will not extend.

Handover requires priority cloud accounts and clusters to export immutable control-plane, workload, identity, data-access and orchestration evidence to an independently administered boundary. Collection gaps must trigger visible alerts, legal-hold procedures must be exercised, two investigations must reproduce their timelines, and the successor must lead one cross-cloud preservation drill with privacy and counsel observers.

The leader may impose preservation holds, isolate affected workloads, require ephemeral-resource capture, redirect responders and approve specialist spend within $2.5 million. Research shutdown beyond twenty-four hours, disclosure, employee action, permanent hiring and production-platform replacement require authorised executive approval. Counsel determines privilege and legal production; principal investigators determine scientific access once forensic gates are met.

General data-platform redesign, laboratory instrument security and enterprise records management are excluded. The appointee will document interfaces where research services or legal retention depend on them but will not own their roadmaps. This assignment centres on cloud-native evidence availability, integrity, interpretation and operational use before, during and after an incident.

Why this seat is open

The breach revealed that a technically rich cloud environment could not answer basic evidential questions after ephemeral resources disappeared. Conflicting timelines undermined counsel, privacy and research confidence in prior leadership. A temporary executive must repair collection and investigation discipline, then exit after permanent ownership proves the system in practice.

What you will own

• Reconstruct the breach chronology across federated identity, cloud control planes, containers, service mesh and genomic object access.
• Define evidence requirements by investigation question, source volatility, privacy sensitivity, retention period and legal-hold need.
• Establish immutable cross-account collection with time synchronisation, collector identity, completeness monitoring and restricted investigative access.
• Design capture for short-lived containers, serverless executions, workload credentials and administrative sessions before underlying resources disappear.
• Create chain-of-custody and analytic-notebook standards that separate collected fact, transformed evidence, inference and unresolved contradiction.
• Exercise malicious workload, deleted account and regional logging-loss scenarios with responders, counsel and research-system owners.
• Transfer collection architecture, case files, authority boundaries and readiness metrics through a successor-led preservation exercise.

Candidate qualifications

• Led cloud-native digital forensics for a material incident involving containers, ephemeral workloads or object-scale sensitive data.
• Can evidence defensible collection from multiple cloud accounts with independent storage, trusted time and documented chain of custody.
• Reconstructed workload and service identity where hosts or containers no longer existed at the time of investigation.
• Worked directly with privacy, counsel, research or regulated-data owners on preservation, privilege and evidence minimisation.
• Designed forensic-readiness controls that exposed collection failure before an incident rather than assuming log delivery was complete.
• Handed investigation authority and tested evidence operations to a permanent leader after a time-bound remediation.

Non-negotiables

• Available within two weeks for the Boston-centred cadence and early incident-intensity working.
• Independent of the incumbent cloud, forensic-response and security-logging vendors involved in the breach.
• Will preserve scientific confidentiality and legal authority while challenging incomplete evidence.
• Has director or CISO-1 authority in cloud forensics, not solely endpoint examination or tool administration.

1. 49 words maximum. State your availability and one ephemeral-workload investigation you personally directed.
2. 49 words maximum. Which evidence source would you preserve first after a short-lived container disappears?
3. 49 words maximum. Describe a collection-completeness failure your readiness control exposed before litigation or disclosure.