Host Based Cyber Systems Analyst III

Argo Cyber Systems•Arlington, VA

5d•Onsite

About The Position

We are seeking experienced Host Forensics Analysts to support a critical federal customer mission. The ideal candidate will bring deep expertise in digital forensics, cyber incident response, host-based investigations, and forensic analysis, along with the ability to operate effectively in government environments. The Host Forensics Analyst will support federal leads and forensic teams during onsite engagements, providing technical expertise throughout the collection, preservation, examination, analysis, and reporting of digital evidence. This position requires strong investigative judgment, attention to forensic integrity, excellent technical writing skills, and the ability to communicate complex findings to both technical and executive stakeholders.

Requirements

U.S. Citizenship
Active TS/SCI security clearance
Ability to obtain DHS Suitability
Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline; or High School Diploma/GED with 10+ years of host or digital forensics experience
Minimum 8 years of directly relevant experience conducting cyber forensic investigations using industry-standard forensic tools and leading-edge technologies.
Demonstrated experience conducting host-based and/or digital forensic investigations.
Experience creating forensically sound duplicates and forensic images of computer systems.
Demonstrated ability to produce comprehensive cyber investigative reports documenting digital forensic findings.
Experience analyzing and characterizing cyber attacks and related digital evidence.
Knowledge of proper digital asset collection, preservation, handling, and chain-of-custody procedures.
Demonstrated ability to identify different classes of cyber attacks and stages of compromise.
Knowledge of system and application security threats, vulnerabilities, and attack methodologies.
Knowledge and experience conducting proactive analysis of systems and networks, including establishing trust levels for critical resources.
Strong technical writing, analytical, communication, and presentation skills.
Ability to work collaboratively with geographically dispersed teams and stakeholders.
Ability and willingness to travel extensively to support onsite incident response engagements.

Nice To Haves

EnCase
SIFT
X-Ways
Volatility
Wireshark
Sleuth Kit / Autopsy
Magnet AXIOM
Cyber Snort
Splunk or other SIEM platforms, including ArcSight, LogRhythm, Elastic, or similar
EDR platforms, including CrowdStrike, Microsoft Defender for Endpoint (MDE), Trellix, or similar technologies
Other industry-standard digital forensics, incident response, SIEM, EDR, or security analysis tools
GIAC Certified Forensic Analyst (GCFA)
GIAC Certified Forensic Examiner (GCFE)
EnCase Certified Examiner (EnCE)
Certified Computer Examiner (CCE)
Certified Forensic Computer Examiner (CFCE)
Certified Information Systems Security Professional (CISSP)

Responsibilities

Assist federal leads with overseeing and leading forensic teams during onsite engagements, including coordinating data collection and acquisition operations.
Provide technical guidance on data collection methods, digital forensic procedures, and investigative techniques to appropriate personnel.
Plan, coordinate, and direct the inventory, examination, and comprehensive technical analysis of computer systems, hosts, and digital artifacts.
Create and maintain forensically sound duplicates and images of computer systems and digital evidence.
Support forensic analysis and mentor junior personnel on data collection, evidence analysis, investigative methodologies, and technical reporting.
Assist with leading and coordinating forensic teams during preliminary investigations and onsite incident response engagements.
Conduct technical analysis of digital evidence to identify indicators of compromise, malicious activity, attack vectors, persistence mechanisms, and other artifacts associated with cyber incidents.
Evaluate, extract, and analyze suspected malicious code and related artifacts.
Analyze and characterize cyber attacks, including identifying attack classes, stages of compromise, tactics, techniques, and procedures.
Ensure appropriate digital evidence collection, preservation, documentation, and chain-of-custody procedures are followed.
Write comprehensive technical reports documenting forensic findings, investigative methodologies, analysis, and conclusions.
Distill complex analytic findings into clear executive summaries and detailed technical reports for leadership and stakeholders.
Conduct peer reviews and quality assurance reviews of forensic products and reports, particularly those prepared by junior personnel.
Serve as a technical forensics liaison to customers and stakeholders, explaining investigative findings, forensic methodologies, protocols, and supporting evidence.
Track and document onsite incident response activities and provide regular status updates to federal leadership throughout an engagement.
Conduct proactive analysis of systems and networks, including evaluating and establishing trust levels for critical resources.
Collaborate effectively with forensic, cybersecurity, incident response, and customer teams operating across multiple physical locations.
Travel to incident response locations throughout the United States, U.S. Territories, and Possessions as Required