Cloud Analyst

Booz Allen Hamilton•McLean, VA

6d•$86,800 - $198,000

About The Position

The Cloud Analyst applies expertise in incident response processes, tools, and techniques to support Business Email Compromise (BEC) investigations. The role collects, analyzes, and presents digital evidence; contributes to solutions for problems of moderate scope and complexity; and makes significant contributions to incident response efforts while working independently with some guidance. The analyst provides written or verbal updates to clients and may lead fast-paced cloud investigations from beginning to end, including presenting forensic findings and preparing executive summary reports. The position requires working outside standard business hours, including evenings, weekends, and holidays; participating in an on-call rotation; and handling more than one incident at a time.

Requirements

At least 3 years of experience with Digital Forensics and Incident Response (DFIR), Incident Response (IR), or BEC investigation.
Experience collecting and analyzing logs in Microsoft 365 (M365).
Experience with scripted BEC toolsets written in PowerShell.
Knowledge of common forensic artifacts analyzed during an investigation.
Ability to correlate events from multiple sources to create a timeline analysis.
Ability to organize case notes and communicate verbally and in writing to clients.
Ability to lead fast-paced cloud investigations from beginning to end, including creating and presenting forensic findings and writing executive summary reports.
High school diploma or GED.
Ability to work after standard business hours, including evenings, weekends, and holidays, take an on-call rotation, and work on more than one incident at a time.

Nice To Haves

Experience collecting and analyzing Microsoft Exchange on-premises logs or Google Workspace logs.
Experience with email header analysis.
Experience collecting and analyzing data from other email platforms.
Experience forensically analyzing cloud data, including AWS, Azure, or GCP.
Experience scripting with PowerShell or Python.
Experience with digital forensic tools, including EnCase, FTK Axiom, Splunk, ELK Stack, and open-source applications.
Ability to prepare detailed technical reports.
Ability to prioritize work assignments without guidance.
DFIR or cybersecurity certification, such as CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA.

Responsibilities

Collect, analyze, and present digital evidence in support of BEC investigations.
Apply functional, working, and general industry knowledge to incident response work.
Develop or contribute to solutions to problems of moderate scope and complexity.
Contribute significantly to incident response efforts while working independently with some guidance.
Provide written or verbal updates to clients.
Lead cloud investigations from beginning to end, including creating and presenting forensic findings and writing executive summary reports.
Work after standard business hours, including evenings, weekends, and holidays; take an on-call rotation; and manage multiple incidents at once.