DFIR Team Lead

Booz Allen Hamilton•McLean, VA

11d•$112,800 - $257,000

About The Position

Lead and inspire a team of incident response analysts, fostering technical expertise, collaboration, and excellent client delivery. Lead incident response for major incidents and coordinate efforts to contain and resolve cybersecurity issues. Provide status updates to critical stakeholders, including cybersecurity and operations leaders and legal teams. Develop, maintain, and review incident documentation; contribute thought leadership for program improvements and new initiatives; and mentor junior team members to support continuous learning and excellence in digital forensics and incident response (DFIR). The role requires analyzing Windows and non-Windows systems and logs, using DFIR tools and scripted toolsets, correlating events into timelines, organizing case notes, communicating with clients, and preparing detailed technical reports. The position may require work outside standard business hours, including evenings and weekends, and participation in an on-call rotation.

Requirements

At least 3 years of experience with digital forensics or incident response.
Experience analyzing Microsoft Windows and non-Windows systems, including Mac or Linux, and using DFIR toolsets such as FTK, EnCase, XWF, and Axiom.
Experience with scripted DFIR toolsets written in Python or PowerShell.
Experience analyzing logs, including firewall, network traffic, IIS, antivirus, and DNS logs.
Knowledge of common forensic artifacts used during incidents to determine attack vector, lateral movement, and data exfiltration.
Ability to correlate events from multiple sources to create a timeline analysis.
Ability to organize case notes and communicate verbally and in writing to clients.
Ability to prepare detailed technical reports.
Ability to work after standard business hours, including evenings and weekends, and take part in an on-call rotation.
High school diploma or GED.

Nice To Haves

Experience forensically analyzing cloud data, including AWS, Azure, or GCP.
Knowledge of mobile device platforms, including smartphones and tablets.
Ability to prioritize work assignments without guidance.
Bachelor’s degree preferred; master’s degree is a plus.
DFIR or cybersecurity certification, such as CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA.

Responsibilities

Lead and inspire a team of incident response analysts.
Lead incident response for major incidents and coordinate efforts to contain and resolve cybersecurity issues.
Provide status updates to cybersecurity and operations leaders, legal teams, and other stakeholders as required.
Develop, maintain, and review documentation for incidents.
Provide thought leadership for program improvements and new initiatives.
Mentor junior team members and foster continuous learning and excellence in DFIR.
Analyze Windows and non-Windows systems, DFIR toolsets, and logs.
Correlate events from multiple sources to create timeline analyses.
Organize case notes, communicate with clients, and prepare detailed technical reports.
Work after standard business hours, including evenings and weekends, and participate in an on-call rotation.