DFIR Team Lead

Booz Allen Hamilton • McLean, VA

5d

About The Position

Lead and inspire a team of incident response analysts while fostering technical expertise, collaboration, and strong client delivery. Lead incident response for major incidents and coordinate efforts to contain and resolve cybersecurity issues. Communicate status updates to critical stakeholders, including cybersecurity and operations leaders and legal stakeholders. Develop, maintain, and review incident documentation; contribute thought leadership for program improvements and new initiatives; and mentor junior team members in the Digital Forensics and Incident Response (DFIR) domain.

The role requires working after standard business hours, including evenings and weekends, and participating in an on-call rotation. Booz Allen describes its compensation and benefits offerings as including health, life, and disability coverage; financial and retirement benefits; paid leave; professional development; tuition assistance; work-life programs; dependent care; and recognition awards. The projected annualized compensation range is $112,800 to $257,000. The role’s work location type is not specified.

Requirements

• At least 3 years of experience with digital forensics or incident response.
• Experience analyzing Microsoft Windows and non-Windows systems, including Mac or Linux, and using DFIR toolsets such as FTK, EnCase, XWF, and Axiom.
• Experience with scripted DFIR toolsets written in Python or PowerShell.
• Experience analyzing logs, including firewall, network traffic, IIS, antivirus, and DNS logs.
• Knowledge of common forensic artifacts used to determine attack vectors, lateral movement, and data exfiltration.
• Ability to correlate events from multiple sources to create timeline analyses.
• Ability to organize case notes and communicate verbally and in writing to clients.
• Ability to prepare detailed technical reports.
• Ability to work after standard business hours, including evenings and weekends, and participate in an on-call rotation.
• High school diploma or GED.

Nice To Haves

• Experience forensically analyzing cloud data, including AWS, Azure, or GCP.
• Knowledge of mobile device platforms, including smartphones and tablets.
• Ability to prioritize work assignments without guidance.
• Bachelor’s degree preferred; master’s degree is a plus.
• DFIR or cybersecurity certification, including CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA.

Responsibilities

• Lead and inspire a team of incident response analysts.
• Lead incident response for major incidents and coordinate efforts to contain and resolve cybersecurity issues.
• Provide status updates to critical stakeholders, including cybersecurity and operations leaders and legal stakeholders.
• Develop, maintain, and review critical incident documentation.
• Provide thought leadership for program improvements and new initiatives.
• Mentor junior team members and foster continuous learning and excellence in DFIR.
• Work after standard business hours, including evenings and weekends, and participate in an on-call rotation.

Benefits

• Health, life, and disability benefits.
• Financial and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED