Cyber Defense Forensics Analyst [Various Levels] Contingent

Lufco•Belleville, IL

1d•$80,000 - $95,000

About The Position

The Cyber Defense Forensics Analyst serves within the Cybersecurity Operations (CSO) capability area to support incident response, threat analysis, and digital evidence processing for global C4ISR and distribution operations. Operating in accordance with DoDM 8140.03 standards, this role performs deep-dive technical investigations, host and network-level artifact recovery, and threat timeline reconstruction to ensure operational effectiveness and mission assurance during active security events.

Requirements

Technical degree in Cybersecurity, Computer Science, Information Technology, or a related field, OR 5+ years of direct operational experience in digital forensics and cyber incident response.
Personnel assigned to this role must satisfy the foundational qualification requirements for DCWF Work Role 612 at an Intermediate proficiency level prior to commencing work.
Must meet residential qualification requirements for elevated or privileged network access prior to performing technical duties.
Execute all information handling in strict accordance with AR 380-5 for classified data and DoDI 5200.48 for Controlled Unclassified Information (CUI).

Nice To Haves

Qualifying certifications: CySA+, GCFA, EnCE, CCE (Intermediate level required)
Active Secret or Top Secret clearance

Responsibilities

Execute digital forensic collections, host-based memory analysis, disk image acquisition, and reverse engineering during operational security incidents.
Maintain strict evidence handling and legal chain-of-custody protocols for all collected host artifacts, network packet captures, and system memory dumps.
Evaluate disk images, volatile memory, system logs, and network traffic captures to reconstruct attack vectors, establish timelines, and determine breach scope and impact.
Assist in technical measures to isolate, contain, eradicate, and recover from security events upon direction from the COR.
Author comprehensive forensic investigation reports and provide technical analysis inputs for formal Security Incident Reports.