Cyber Investigations Analyst - OTA / Active Top Secret
About The Position
Peraton is seeking a Cyber Investigations Analyst to join its Federal Strategic Cyber Group and support the Cyber Threat Investigations & Analysis Division (CTAD). The role conducts end-to-end insider threat and cyber investigations using User Activity Monitoring (UAM) tools and data. It is based in Rosslyn, Virginia; a full-time hybrid schedule may be an option after 90 days. The analyst examines user activity logs, endpoint telemetry, and network data to identify anomalous behavior, policy violations, and potential insider threats. The position also develops detection rules, alerts, and behavioral baselines; supports escalated incident response; and provides investigative guidance to stakeholders and junior team members. The analyst documents findings in formal reports, bulletins, and advisories, maintains case records in SharePoint, and works with legal, HR, and security teams to ensure investigations follow applicable laws, policies, and Department guidelines.
Requirements
- Bachelor’s degree and 5 years of experience; an additional 4 years of experience may substitute for the bachelor’s degree requirement.
- At least 2 years of experience in cybersecurity, digital forensics, or cyber investigations.
- Must possess and maintain, or obtain before the start date, Security+ CE certification.
- Experience conducting insider threat or cyber misconduct investigations in an enterprise environment.
- Experience analyzing large datasets of user activity, log data, and endpoint telemetry.
- Strong analytical, problem-solving, and decision-making skills for complex, sensitive investigations.
- Excellent written and verbal communication skills, including experience producing formal investigative reports.
- Strong time management skills and ability to complete assigned tasks with minimal supervision.
- U.S. citizenship required.
- Active Top Secret security clearance required.
- Ability to obtain a final Top Secret/SCI security clearance.
Nice To Haves
- Experience with insider threat programs and familiarity with the National Insider Threat Policy.
- Familiarity with SIEM platforms such as Splunk or Microsoft Sentinel for correlating UAM data with broader security telemetry.
- Experience with digital forensics tools such as EnCase, FTK, or Magnet AXIOM.
- Knowledge of Active Directory and Azure AD for user account analysis.
- Experience in a government or federal law enforcement investigative environment.
- Technical writing skills and experience producing materials for senior leadership audiences.
- Familiarity with chain of custody procedures and eDiscovery processes.
- Experience with behavioral analytics platforms or UEBA tools.
Responsibilities
- Support CTAD in conducting end-to-end insider threat and cyber investigations using UAM tools and data.
- Collect, analyze, and interpret log data to detect anomalous user behavior, policy violations, and potential insider threats across enterprise systems.
- Develop and refine detection rules, alerts, and behavioral baselines.
- Conduct forensic analysis of user activity logs, endpoint telemetry, and network data to support investigations and produce actionable intelligence.
- Communicate investigative findings to technical and non-technical stakeholders, including senior management.
- Collaborate with legal, HR, and security teams to conduct investigations in accordance with applicable laws, policies, and Department guidelines.
- Write investigation reports, bulletins, and advisories documenting findings.
- Promote awareness of insider threat indicators and UAM best practices among customer stakeholders, coworkers, and Department users.
- Respond to escalated security incidents and provide expert guidance on user activity-related threat vectors.
- Manage case documentation and investigative records in SharePoint repositories.
- Guide and mentor junior team members on investigative techniques and tool usage.
- Stay current on emerging insider threat tactics, techniques, and procedures and incorporate findings into detection strategies.
Benefits
- Employees may be eligible for overtime, shift differential, and a discretionary bonus, depending on the position.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
