Cloud Analyst

Booz Allen Hamilton•McLean, VA

1h•$86,800 - $198,000•Remote

About The Position

The Cloud Analyst applies professional knowledge of incident response processes, tools, and techniques to collect, analyze, and present digital evidence in support of Business Email Compromise (BEC) investigations. The role applies functional, working, and general industry knowledge to solve problems of moderate scope and complexity, works independently with some guidance, and contributes significantly to incident response efforts. The analyst provides written and verbal updates to clients and may lead cloud investigations from start to finish, including presenting forensic findings and preparing executive summary reports. This position is remote, although occasional work at a Booz Allen or customer facility may be required. The role may involve working after standard business hours, including evenings, weekends, and holidays, participating in an on-call rotation, and handling multiple incidents at once.

Requirements

At least 3 years of experience with Digital Forensics and Incident Response (DFIR), Incident Response (IR), or BEC investigations.
Experience collecting and analyzing logs in Microsoft 365 (M365).
Experience with scripted BEC toolsets written in PowerShell.
Knowledge of common forensic artifacts analyzed during an investigation.
Ability to correlate events from multiple sources to create a timeline analysis.
Ability to organize case notes and communicate verbally and in writing to clients.
Ability to lead fast-paced cloud investigations from beginning to end, including creating and presenting forensic findings and writing executive summary reports.
Ability to work after standard business hours, including evenings, weekends, and holidays; participate in an on-call rotation; and work on more than one incident at a time.
High school diploma or GED.

Nice To Haves

Experience collecting and analyzing Microsoft Exchange on-premises logs or Google Workspace logs.
Experience with email header analysis.
Experience collecting and analyzing logs from other email platforms.
Experience forensically analyzing cloud data, including AWS, Azure, or GCP.
Experience scripting with PowerShell or Python.
Experience with digital forensic tools, including EnCase, FTK Axiom, Splunk, ELK Stack, and open-source applications.
Ability to prepare detailed technical reports.
Ability to prioritize work assignments without guidance.
DFIR or cybersecurity certification such as CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA.

Responsibilities

Collect, analyze, and present digital evidence in support of Business Email Compromise investigations.
Contribute to incident response efforts and develop solutions to problems of moderate scope and complexity.
Lead cloud investigations from beginning to end, including creating and presenting forensic findings.
Write executive summary reports and organize case notes.
Provide written or verbal updates to clients.
Work an on-call rotation and handle multiple incidents concurrently, including work outside standard business hours.