Intrusion Analyst

Full Visibility

About The Position

Full Visibility is seeking Intrusion Analysts in Linthicum, Maryland. The role conducts forensic examinations of network intrusions, compromised systems, advanced persistent threats, and cyber incidents. Analysts develop scripts and analytical utilities for artifact triage, extraction, and timeline development; identify indicators of compromise and adversary behaviors; analyze digital evidence; and reconstruct user activity while maintaining chain of custody and following laboratory procedures. The position performs initial triage to determine examination scope and support case prioritization. It also prepares technically accurate Malware Analysis Reports and may support tool validation, peer reviews, expert-witness preparation, quality assurance, operational metrics, training, and process improvement. The posting describes four experience levels, from Intrusion Analyst 1 through Intrusion Analyst 4.

Requirements

Must possess an active Secret clearance; Top Secret clearance/SCI eligibility is preferred.
A bachelor's degree in digital forensics, computer science, cybersecurity, information technology, criminal justice, or a related field; four years of hands-on experience in a digital forensics/intrusion analysis role may substitute for the degree.
For Level 4, possession of at least one active listed certification or an equivalent certification approved by the COR is required; certification is preferred for Levels 1, 2, and 3. Listed certifications include GIAC Certified Incident Handler (GCIH), EC-Council Certified Incident Handler (ECIH), GIAC Certified Forensic Analyst (GCFA), and DC3 Cyber Training Academy Digital Forensic Examiner (DFE).
Minimum hands-on digital forensics/intrusion analysis experience: 2 years for Intrusion Analyst 1, 5 years for Intrusion Analyst 2, 8 years for Intrusion Analyst 3, and 12 years for Intrusion Analyst 4.
If assigned to certain job tasks, verifiable completion within the last three years of formal training dedicated to expert-witness testimony, rules of evidence, and courtroom procedure is required.

Nice To Haves

Top Secret clearance/SCI eligibility.
An active listed certification or an equivalent certification approved by the COR for Levels 1, 2, or 3.

Responsibilities

Conduct forensic examinations of network intrusions, compromised systems, advanced persistent threats, and cyber incidents.
Develop scripts and analytical utilities for artifact triage, extraction, and timeline development.
Identify indicators of compromise and adversary behaviors.
Analyze digital evidence and reconstruct user activity while maintaining chain of custody and complying with laboratory procedures.
Perform initial triage to determine examination scope and support case prioritization.
Prepare technically accurate Malware Analysis Reports.
May support tool validation, peer reviews, expert-witness preparation, quality assurance, operational metrics, training, and process improvement.