A forensic analyst is the role best suited to perform in-depth evidence gathering and analysis required to reconstruct timelines, determine scope, and establish root cause for a data leak. This work includes preserving evidence (ensuring integrity), collecting endpoint and server artifacts, reviewing authentication and repository access logs, correlating commit history with identity and device telemetry, and building a defensible chain of events for leadership and potential legal/regulatory review. The SOC manager coordinates resources and priorities but typically does not perform hands-on forensic reconstruction. A subject matter expert may provide domain expertise (e.g., on Git workflows, cloud platforms, or database systems), but forensic rigor and evidence handling are the core requirement here. A threat intelligence analyst focuses on external adversary information, campaigns, and indicators; they can assist with context but are not the primary role for internal evidence reconstruction. Because the CISO needs timeline, extent, and root cause—deliverables that depend on digital evidence handling and forensic methodology—the forensic analyst is the critical assignment.