Digital Forensic Examiner, Mid

Booz Allen Hamilton•Washington, DC

2d•$69,400 - $158,000

About The Position

As a Digital Forensics and Incident Response (DFIR) Examiner, you will serve in an intermediate to advanced role to the DFIR space. You will be tasked with leading DFIR matters as assigned by the Digital Forensic Examiner Lead or Digital Forensic Examiner Senior Team lead. You will collect, analyze, and present digital-related evidence in support of computer criminal investigations. As an Examiner, you will apply specific functional knowledge, and working and general industry knowledge. In this role you will develop or contribute to solutions on a variety of problems of moderate scope and complexity. You will work independently along with some guidance, and may review or guide activities of more junior employees.

Requirements

Experience with full life-cycle case management of large scale and complex investigations, and direct report management of personnel on cases
Experience working with Microsoft Windows and non-Windows systems such as Mac or Linux, and with scripting or programming such as PowerShell or Python
Experience with training, mentoring, or leadership
Experience in forensic and incident response methodology
Ability to take detailed notes and write reports, and effectively communicate with counsel, client leadership, and high-level management
Ability to prioritize work assignments, and work independently in highly collaborative team environments
Ability to correlate events from multiple sources to create a timeline analysis
Ability to perform log analysis of multiple types
Ability to identify misuse, malware, or unauthorized activity through forensic or log analysis
HS diploma or GED

Nice To Haves

1+ years of experience with Incident Response or Digital Forensics
Experience with digital forensic tools including EnCase, FTK, Axiom, Splunk, Elk Stack, and open-source applications
Experience working with mobile devices preferred
Experience with endpoint detection and response tools such as SentinalOne preferred
Bachelor’s degree in cyber security preferred; Master’s degree a plus
Two or more Certifications preferred, including CCE, EnCE, CFCE, ACE, CISSP, GIAC Certified Intrusion Analyst (GCIA), GCFE, GCFA, GREM, or GNFA certification

Responsibilities

Assist and Lead scoping calls of potential new matters
Generate necessary paperwork and data entry for new matters
Manage cyber incident response investigations requiring forensic, malware, and log analysis
Collect and analyze forensic images and triage datasets to identify the presence of malware and the actions taken
Collected and analyze malware, and logs from various types
Determine whether unauthorized accessor data ex-filtration occurred
Analyze systems to identify Indicators of Compromise (IOCs)
Provide analysis results for senior level review, both written and oral communications
Provide analysis results orally to clients
Prepare detailed technical reports in an understandable manner
Perform other duties as assigned