Intrusion Analyst - (Mid-Sr Levels)

Parsons Corporation•Minneapolis, MN

12d•$125,100 - $225,200

About The Position

Parsons is hiring a mid- to senior-level Intrusion Analyst for its Federal Solutions team. The analyst conducts forensic examinations of network intrusions, malicious activity, compromised systems, advanced persistent threats, and cyber incidents, and develops actionable analysis to support investigative and cybersecurity operations. The position includes evidence examination and handling, malware analysis reporting, development and validation of analytical tools, technical peer review, quality assurance, metrics, and support for training and process improvement. The role requires an active Secret clearance. A bachelor’s degree in a related field is required, although four years of hands-on digital-forensics or intrusion-analysis experience may substitute for the degree. Required experience varies by level: at least eight years for Intrusion Analyst 3 and at least 12 years for Intrusion Analyst 4. A Top Secret clearance with SCI eligibility and other listed qualifications are preferred.

Requirements

Active Secret security clearance.
Bachelor’s degree in Digital Forensics, Computer Science, Cybersecurity, Information Technology, Criminal Justice, or a related field; four years of hands-on digital-forensics or intrusion-analysis experience may substitute for the degree.
Hands-on digital-forensics or intrusion-analysis experience appropriate to the assigned level: at least eight years for Intrusion Analyst 3 or at least 12 years for Intrusion Analyst 4.
Ability to analyze network intrusions, malicious activity, compromised systems, advanced persistent threats, and cyber incidents.
Experience identifying indicators of compromise, persistence mechanisms, lateral movement, command-and-control activity, privilege escalation, credential abuse, and other adversary behaviors.
Ability to perform forensic image and extraction review, hashing, timestamp analysis, artifact interpretation, anti-forensic detection, and user-activity reconstruction.
Experience maintaining chain-of-custody documentation and handling evidence in accordance with laboratory procedures and security requirements.
Ability to prepare accurate, complete, professionally formatted Malware Analysis Reports.
Strong analytical, technical, investigative, documentation, and written communication skills.
Ability to work independently and collaborate with investigators, cybersecurity personnel, technical reviewers, government representatives, and multidisciplinary teams.

Nice To Haves

Top Secret clearance with SCI eligibility.
Formal training dedicated to expert-witness testimony, rules of evidence, and courtroom procedure, such as DC3’s 40-hour Forensic Trial Training course, completed within the last three years when required for assigned duties.
Experience developing scripts and analytical utilities for artifact triage, extraction, timeline development, or repetitive analysis tasks.
Experience validating malware-analysis tools, verifying tool outputs, documenting validation results, and using version-control practices.
Experience supporting peer review, expert-witness preparation, affidavits, warrants, depositions, moot court sessions, or courtroom testimony.
Experience supporting quality-assurance programs, SOP implementation, accreditation activities, competency testing, audits, and laboratory metrics.
Experience analyzing malware, network traffic, system artifacts, persistence mechanisms, lateral movement, command-and-control activity, and advanced persistent threat behavior.
Experience supporting training, mentorship, process improvement, and lessons-learned activities.
At least one active certification, or an equivalent certification approved by the COR, including GIAC Certified Incident Handler, EC-Council Certified Incident Handler, GIAC Certified Forensic Analyst, or DC3 Cyber Training Academy Digital Forensic Examiner.

Responsibilities

Conduct forensic examinations of network intrusions, malicious activity, compromised systems, advanced persistent threat activity, and cyber incidents.
Develop or maintain scripts and analytical utilities for artifact triage and extraction, timeline development, and repetitive examination tasks.
Identify indicators of compromise, persistence mechanisms, lateral-movement activity, command-and-control activity, privilege escalation, credential abuse, and other adversary behaviors.
Perform evidence identification, forensic image and extraction review, hashing, timestamp analysis, artifact interpretation, anti-forensic detection, and user-activity reconstruction.
Conduct initial forensic triage to identify key artifacts, determine examination scope, and support case assignment and prioritization.
Maintain accurate chain-of-custody documentation and handle, store, transfer, and dispose of evidence according to laboratory procedures and security requirements.
Prepare complete, technically accurate, professionally formatted Malware Analysis Reports.
Validate malware-analysis tools, document validation results, verify tool outputs, and develop or maintain approved scripts using version-control practices, as assigned.
Participate in technical peer reviews of forensic reports and incorporate review comments.
Support expert-witness preparation, affidavits, warrants, mock depositions, moot court sessions, and testimony when designated and qualified.
Support quality-assurance activities, including SOP implementation, audit readiness, competency testing, and accreditation-related documentation.
Support collection and analysis of metrics involving case volume, backlog, throughput, cycle time, timeliness, workload, rework, error rates, and quality indicators.
Provide technical input to training, mentorship, process-improvement, and lessons-learned activities.