Intrusion Analyst

Full Visibility LLC • Linthicum Heights, MD

6d • $110,000 - $210,000 • Onsite

About The Position

Full Visibility is seeking Intrusion Analysts in Linthicum, Maryland. The role involves conducting forensic examinations of network intrusions, compromised systems, advanced persistent threats, and cyber incidents. Analysts develop scripts and analytical utilities for artifact triage, extraction, and timeline development; identify indicators of compromise and adversary behaviors; analyze digital evidence; and reconstruct user activity while maintaining chain of custody and following laboratory procedures. They perform initial triage to determine examination scope and support case prioritization. The position also includes preparing technically accurate Malware Analysis Reports and may involve tool validation, peer reviews, expert-witness preparation, quality assurance, operational metrics, training, and process improvement.

The position has four experience levels, with minimum hands-on digital forensics or intrusion analysis experience ranging from two years for Level 1 to twelve years for Level 4. An active Secret clearance is required; Top Secret clearance or SCI eligibility is preferred. At least one listed active certification, or an equivalent approved by the COR, is required for Level 4 and preferred for Levels 1, 2, and 3. A relevant bachelor's degree is required, although four years of hands-on experience in a digital forensics or intrusion analysis role may substitute. For certain assigned tasks, recent formal training in expert-witness testimony, rules of evidence, and courtroom procedure is required.

Requirements

• Possess an active Secret clearance; Top Secret clearance or SCI eligibility is preferred.
• For Level 4, possess at least one active certification from the accepted list, or an equivalent certification approved by the COR; certification is preferred for Levels 1, 2, and 3. Accepted certifications listed include GIAC Certified Incident Handler (GCIH), EC-Council Certified Incident Handler (ECIH), GIAC Certified Forensic Analyst (GCFA), and DC3 Cyber Training Academy Digital Forensic Examiner (DFE).
• Have a bachelor's degree in digital forensics, computer science, cybersecurity, information technology, criminal justice, or a related field; four years of hands-on experience in a digital forensics or intrusion analysis role may substitute for the degree.
• If assigned to certain tasks, have verifiable completion within the last three years of formal training dedicated to expert-witness testimony, rules of evidence, and courtroom procedure (for example, DC3's 40-hour Forensic Trial Training course).
• Intrusion Analyst 1: at least two years of hands-on digital forensics or intrusion analysis experience.
• Intrusion Analyst 2: at least five years of hands-on digital forensics or intrusion analysis experience.
• Intrusion Analyst 3: at least eight years of hands-on digital forensics or intrusion analysis experience.
• Intrusion Analyst 4: at least twelve years of hands-on digital forensics or intrusion analysis experience.

Nice To Haves

• Top Secret clearance or SCI eligibility.
• An accepted active certification, or equivalent approved by the COR, for Levels 1, 2, and 3.

Responsibilities

• Conduct forensic examinations of network intrusions, compromised systems, advanced persistent threats, and cyber incidents.
• Develop scripts and analytical utilities for artifact triage, extraction, and timeline development.
• Identify indicators of compromise and adversary behaviors.
• Analyze digital evidence and reconstruct user activity while maintaining chain of custody and complying with laboratory procedures.
• Perform initial triage to determine examination scope and support case prioritization.
• Prepare technically accurate Malware Analysis Reports.
• May support tool validation, peer reviews, expert-witness preparation, quality assurance, operational metrics, training, and process improvement.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level