A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is entirely focused on firefighting network/operations issues and expanding its services, security is only an afterthought and is rarely a priority. Now it is 2018 and in light of many high profile breaches the company decides they should make security a priority and for the first time in the company's history they dedicate a single employee whose full time job is security. The employee puts in place standards such as patch management, vulnerability scanning, stricter firewall monitoring, etc. etc. After a month in his position the employee is asked by the general manager, "So, is anybody in our network who shouldn't be?"
The question is, what are some ways the employee can use forensics to try to discover an adversary presence that will have likely existed since well before his appointment? Will the employee ever be able to do say with confidence that the network is clear of intruders, even after extensive and thorough forensic investigation?
Sorry for the lengthy explanation, just wanted to give details to help potential respondents understand the high level of probability that there is someone in already. Any words of wisdom appreciated.