Digital Forensic Analyst

Koniag Government Services•Washington, DC

8d•Hybrid

About The Position

Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced Digital Forensics Analyst to support cybersecurity operations and incident response activities for a federal government client. This position requires an active security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations prior to performing work. Primary work will be performed at the client site in Washington, DC and approved remote/telework locations. This role serves as a critical technical function responsible for the collection, preservation, examination, and analysis of digital evidence in support of cybersecurity incident investigations, insider threat inquiries, litigation holds, and other forensic examination requirements across a complex, geographically distributed federal IT enterprise environment. The ideal candidate is a technically proficient and detail-oriented forensics professional with deep expertise in digital forensics methodologies, forensic tool suites, incident response procedures, and chain of custody requirements within a federal government context. This individual must possess the analytical rigor, technical depth, and professional judgment required to conduct thorough, defensible forensic examinations across a diverse range of digital media, operating systems, cloud environments, and enterprise platforms. The Digital Forensics Analyst will serve as the program's primary technical expert for all digital forensics activities, supporting cybersecurity incident investigations, insider threat inquiries, e-discovery and litigation hold support, malware analysis, and forensic examination of digital media across a complex federal enterprise IT environment. This individual is responsible for ensuring all forensic activities are conducted in accordance with established forensic methodologies, chain of custody requirements, applicable Federal regulations, and client policies, producing thorough, well-documented, and legally defensible forensic examination reports and evidentiary findings.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, Information Technology, Information Systems, or a related field from an accredited college or university. Equivalent combination of education and directly relevant experience may be considered.
Minimum of 5 years of hands-on experience in digital forensics, cybersecurity incident response, or a closely related discipline within a federal government IT contracting or law enforcement environment.
Demonstrated hands-on experience conducting forensic examinations of Windows and Linux-based systems, including disk forensics, memory forensics, log analysis, and forensic timeline reconstruction.
Experience conducting forensic investigations in cloud environments, including Microsoft 365, Azure, or AWS.
Experience maintaining chain of custody and producing legally defensible forensic examination reports suitable for submission to legal or law enforcement authorities.
Active security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations.
Exceptional analytical and critical thinking skills with demonstrated ability to conduct thorough, methodical, and well-documented forensic examinations across a diverse range of digital evidence types, platforms, and investigation scenarios.
Deep technical proficiency with industry-standard digital forensics tools, including one or more of the following: Magnet AXIOM, EnCase, FTK (Forensic Toolkit), Cellebrite UFED, Volatility, Autopsy, X-Ways Forensics, or equivalent platforms.
Strong proficiency in forensic acquisition techniques, including disk imaging, memory acquisition, network traffic capture, and cloud evidence collection, with demonstrated ability to ensure evidence integrity through proper hashing and write-blocking procedures.
Demonstrated experience in Windows forensic artifact analysis, including NTFS file system forensics, Windows registry analysis, Windows event log analysis, prefetch and LNK file analysis, and browser artifact examination.
Experience with Linux and/or macOS forensic artifact analysis, including file system forensics, log analysis, and user activity reconstruction.
Proficiency in memory forensics, including volatile memory acquisition and analysis using tools such as Volatility or equivalent platforms.
Experience with log analysis and correlation across diverse log sources, including Windows event logs, Sysmon, network device logs, web server logs, and cloud platform audit logs.
Familiarity with malware analysis techniques, including static analysis (e.g., PE analysis, string extraction, YARA rule development) and dynamic analysis (e.g., sandbox execution and behavioral analysis).
Experience with network forensics, including PCAP analysis using tools such as Wireshark or equivalent platforms, and network flow analysis for investigation support.
Knowledge of cloud forensics techniques and evidence sources across Microsoft 365 (e.g., Unified Audit Log, Exchange Online, SharePoint, Teams), Azure, and/or AWS environments.
Strong chain of custody documentation skills with demonstrated ability to maintain accurate and complete evidence logs and produce professionally formatted, legally defensible forensic examination reports.
Excellent written and verbal communication skills with the demonstrated ability to present complex technical forensic findings clearly and accurately to diverse audiences including program leadership, Government stakeholders, and legal counsel.
Familiarity with applicable Federal forensic and cybersecurity standards, including NIST SP 800-86, NIST SP 800-53, FISMA, and Federal Rules of Evidence requirements.
Proficiency with scripting languages (e.g., Python, PowerShell, or Bash) for forensic automation, data parsing, and analysis workflow development.

Nice To Haves

Prior experience supporting digital forensics and incident response on a federal IT program of comparable scale and complexity.
Experience conducting mobile device forensics, network forensics, and/or malware analysis in support of federal cybersecurity investigations.
Experience supporting e-discovery and litigation hold activities in a federal government context.
Certified Forensic Computer Examiner (CFCE), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Forensic Examiner (GCFE), EnCase Certified Examiner (EnCE), AccessData Certified Examiner (ACE), or equivalent industry-recognized digital forensics certification.
GIAC Certified Incident Handler (GCIH), GIAC Certified Enterprise Defender (GCED), Certified Information Systems Security Professional (CISSP), or equivalent cybersecurity certification.
GIAC Reverse Engineering Malware (GREM) certification or demonstrated equivalent malware analysis expertise.
Cellebrite Certified Mobile Examiner (CCME) or equivalent mobile device forensics certification.
Experience with Security Information and Event Management (SIEM) platforms (e.g., Splunk, Microsoft Sentinel, or equivalent) for log aggregation, query development, and investigation support.
Experience with threat intelligence platforms and the practical application of threat intelligence to forensic investigation and indicator of compromise development.
Familiarity with MITRE ATT&CK framework and its application to forensic investigation, attacker TTP identification, and incident reconstruction.
Experience supporting insider threat investigations, including the forensic analysis of user activity, data exfiltration indicators, and behavioral anomalies.
Experience with e-discovery platforms and electronically stored information (ESI) processing workflows in support of Federal litigation hold and legal matter requirements.
Knowledge of Zero Trust Architecture principles (NIST SP 800-207, OMB M-22-09) and their practical application to forensic investigation and incident response within a federal enterprise IT environment.
Experience with YARA rule development and application for malware identification and forensic artifact classification.
Familiarity with Section 508 compliance requirements for digital tools and reporting products delivered under federal contracts.
Experience developing and delivering forensic training, knowledge transfer sessions, or awareness materials for program personnel and Government stakeholders.

Responsibilities

Conduct comprehensive digital forensic examinations of a wide range of digital media and platforms, including hard drives, solid-state drives, removable media, mobile devices, network devices, servers, virtual machines, and cloud environments (e.g., AWS, Microsoft Azure/Microsoft 365).
Perform forensic acquisition of digital evidence using industry-standard forensic imaging tools and techniques, ensuring the integrity and admissibility of all acquired evidence through proper application of write-blocking, hashing, and chain of custody procedures.
Analyze acquired forensic images for relevant artifacts, including deleted files, file system metadata, registry entries, event logs, browser history, email artifacts, user activity records, network connection logs, and other evidentiary data relevant to the investigation.
Conduct memory forensics, including volatile memory acquisition and analysis, to identify running processes, network connections, injected code, encryption keys, and other artifacts not present in disk-based evidence.
Perform log analysis and correlation across endpoint, network, application, and cloud platform log sources to reconstruct timelines of activity, identify indicators of compromise (IOCs), and support investigation findings.
Conduct static and dynamic malware analysis to identify malicious code capabilities, behaviors, command-and-control infrastructure, persistence mechanisms, and indicators of compromise associated with investigated incidents.
Analyze network traffic captures (PCAPs) and network flow data to identify malicious activity, data exfiltration, unauthorized access, lateral movement, and other network-based indicators relevant to active investigations.
Perform mobile device forensics, including logical and physical acquisition and analysis of iOS and Android devices, recovering relevant communications, application data, location history, and user activity artifacts.
Conduct cloud forensics activities across enterprise cloud environments, including the collection and analysis of cloud audit logs, storage artifacts, identity and access management records, and other cloud-native evidence sources.
Support e-discovery and litigation hold activities, including the identification, preservation, collection, and processing of electronically stored information (ESI) in accordance with applicable legal requirements and client policies.
Serve as the forensics subject matter expert within the incident response team, providing timely and expert forensic support across all phases of the incident response lifecycle, from initial detection and containment through eradication, recovery, and post-incident review.
Respond to cybersecurity incidents requiring forensic investigation, deploying forensic capabilities rapidly to collect and preserve volatile and non-volatile evidence before it is lost or altered.
Conduct forensic triage of affected systems and environments to rapidly characterize the scope, nature, and impact of security incidents, providing actionable intelligence to incident response and operations teams in support of containment and eradication decisions.
Develop and maintain incident-specific forensic timelines, reconstructing the sequence of attacker or insider actions from available evidence to support root cause analysis, impact assessment, and lessons learned activities.
Coordinate with the NOC, Security Operations Center (SOC), and other functional teams to ensure forensic activities are integrated effectively into the broader incident response process.
Support post-incident review activities, providing forensic findings, timeline reconstructions, and evidentiary analysis to inform root cause determinations and corrective action recommendations.
Establish, maintain, and enforce rigorous chain of custody procedures for all digital evidence collected, processed, and stored under the program, ensuring all evidence handling activities are documented in accordance with applicable legal and regulatory requirements.
Maintain accurate and complete evidence logs, documenting the acquisition, transfer, storage, examination, and disposition of all digital evidence items throughout their lifecycle.
Ensure all digital evidence is stored securely in accordance with applicable client policies, Federal regulations, and evidence handling best practices, protecting evidence integrity and preventing unauthorized access, alteration, or destruction.
Support the preparation and organization of digital evidence for submission to law enforcement, legal counsel, or other authorized parties as directed by the Government.
Prepare comprehensive, well-structured, and legally defensible forensic examination reports documenting examination scope, methodologies, tools used, findings, evidence items, and conclusions for each completed forensic investigation.
Develop and maintain forensic case files, ensuring all examination notes, tool output, evidence logs, chain of custody records, and supporting documentation are organized, complete, and accessible throughout the investigation lifecycle.
Present forensic findings clearly and effectively to diverse audiences, including program leadership, Government stakeholders, legal counsel, and, where required, law enforcement or investigative authorities, translating complex technical findings into clear, actionable narratives.
Develop and maintain forensic process documentation, standard operating procedures, and examination templates to ensure consistency, repeatability, and quality across all forensic examination activities.
Contribute forensic findings and indicators of compromise to the program's threat intelligence repository, supporting broader detection, prevention, and response capabilities.
Maintain and administer the program's forensic tool suite, ensuring all forensic tools and platforms are properly licensed, configured, updated, and validated for operational use.
Stay current with emerging digital forensics techniques, tools, threat actor tactics, techniques, and procedures (TTPs), and evolving evidentiary standards, incorporating new capabilities and methodologies into the program's forensic practice as appropriate.
Develop and maintain custom scripts, queries, and analysis frameworks to enhance forensic examination efficiency, automate repetitive analysis tasks, and extend forensic coverage across diverse evidence types and platforms.
Support the development and delivery of forensic awareness training and knowledge transfer activities for program personnel and Government stakeholders as directed.
Evaluate and recommend new forensic tools, platforms, and capabilities to enhance the program's forensic examination capabilities in response to evolving threats and client requirements.
Ensure all digital forensics activities are conducted in full compliance with applicable Federal statutes, regulations, and client policies, including FISMA, NIST SP 800-53, NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response), applicable privacy laws, and Federal Rules of Evidence requirements.
Support compliance with applicable cybersecurity frameworks and requirements, including NIST SP 800-207 Zero Trust Architecture, OMB M-22-09, and client-specific cybersecurity policies.
Ensure all forensic activities involving personally identifiable information (PII), protected health information (PHI), CUI, or other sensitive data categories are conducted in accordance with applicable privacy protection requirements and data handling restrictions.
Support audit readiness activities by maintaining organized, complete, and accessible forensic case documentation and compliance evidence files.