Network Forensics Analyst

BCMC • Arlington, VA

2d

About The Position

Nightwing is seeking a Network Forensics Analyst to support the DHS Hunt and Incident Response Team (HIRT), which secures the nation’s infrastructure through front-line cyber incident response and proactive hunting. The role supports on- and offsite incident response for government agencies and critical infrastructure owners, providing advanced technical assistance, proactive hunting, rapid onsite response, and investigations using host- and network-based cybersecurity analysis. The analyst will bring deep expertise in one or more edge-device technologies, particularly Cisco, Ivanti, Palo Alto, Ciena, or Juniper.

The analyst serves as a network-centric hunt and incident response subject matter expert, analyzing traffic, device logs, configurations, and telemetry to detect, scope, and reconstruct intrusions. The position also supports evaluation and integration of new network forensic and monitoring capabilities, incident coordination, customer communications, containment and eradication, evidence preservation, and production of technical guidance and reports. The role requires independent technical judgment on complex problems and collaboration with Government leads, technical personnel, and stakeholders.

Requirements

• U.S. citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• At least 8 years of directly relevant experience.
• At least 3 years of experience evaluating and implementing new cyber response or network forensic capabilities.
• Hands-on incident response or network operations experience with enterprise edge devices from at least two of these vendors: Cisco, Ivanti, Palo Alto, Ciena, or Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of CND policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to characterize and analyze network traffic to identify anomalous activity and potential threats.
• Ability to identify and analyze anomalies using network metadata such as flow, DNS, and proxy data.
• Ability to reconstruct malicious activity using network traffic and device logs.
• Understanding of attack stages, including reconnaissance, initial access, lateral movement, and exfiltration, and how they manifest across a network.
• Understanding of system and application security threats and vulnerabilities and how they appear in network traffic.
• Understanding of proactive systems and network analysis, including establishing trust levels for critical resources and detecting anomalous behavior.
• Proficiency with common operating systems such as Linux/Unix and Windows.
• Experience performing cyber incident response, including scoping, containment, eradication, and recovery, in operational environments.
• Ability to think independently, make sound decisions under pressure, and work with limited guidance.
• Strong written and oral communication skills, including explaining technical issues to technical and non-technical stakeholders.
• Ability to collaborate across physical locations and within distributed teams.
• Skill in identifying classes of attacks and attack stages and translating findings into actionable recommendations.
• Ability to rapidly configure network TAPs, packet brokers, SPAN ports, and managed or unmanaged switches without disrupting live production or air-gapped traffic.
• Bachelor’s degree in Computer Science, Cyber Security, Computer Engineering, or a related field; alternatively, a high school diploma and at least 10 years of technical experience in the area of expertise.

Nice To Haves

• Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
• Network and system administration experience in large or complex enterprise or service-provider environments.
• Strong understanding of adversarial TTPs, including MITRE ATT&CK, and operational threat environments involving varied adversaries.
• Knowledge of defense-in-depth and zero-trust principles and their application to network and edge-device architectures.
• Knowledge of system and application security threats and vulnerabilities, such as buffer overflows, mobile code, cross-site scripting, injection, race conditions, covert channels, replay, ROP, and malicious code.
• Knowledge of network device integrity verification and monitoring approaches.
• Hands-on host and network intrusion detection and event correlation across telemetry sources such as firewalls, IDS/IPS, endpoint tools, and SIEM.
• Experience analyzing malicious activity, including network beaconing, command and control, and data exfiltration.
• Experience with Identity and Access Management (IAM) tools and their integration into network and edge security architectures.
• Ability to review Enterprise Architecture from a security perspective and recommend architecture-level improvements.
• Ability to collaborate with stakeholders at technical, management, and senior leadership levels.
• Field diagnostics and cyber forensics skills, including preloaded analysis stacks, protocol parsers such as Modbus, DNP3, and OPC UA, vulnerability scanning, and local packet capture at line rate.
• Ability to pack, secure, and transport ruggedized cases such as Pelican or Nanuk cases within standard weight and carry-on or air-transport limits.
• One or more desired certifications: IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, or CEH.
• SANS GIAC GCIA or GNFA certification, preferred for network forensics.
• SANS GRID, GICSP, or GCIP certification.
• Vendor or network certifications, highly desired, such as Cisco CCNA or higher (CCNP Security or CCNP Enterprise), or certifications for Palo Alto, Juniper, Ciena, or Ivanti (such as PCNSE or JNCIS/JNCIP).

Responsibilities

• Serve as a hunt and incident response subject matter expert, applying knowledge of threat actor tools, techniques, and procedures, especially network-centric and edge-device compromises.
• Evaluate and integrate new network forensic and monitoring capabilities as part of a technology insertion team.
• Assist the Government lead in coordinating preliminary incident response investigations, including onsite and remote engagements.
• Communicate incident status, findings, and recommendations to customers during onsite engagements.
• Characterize and analyze network traffic, including PCAP, flow data, and device logs, to identify anomalous activity and potential threats.
• Analyze traffic metadata, including flow records, DNS logs, and proxy logs, to detect and scope malicious activity.
• Reconstruct malicious activity from network traffic, including timelines, attacker paths, and data exfiltration patterns.
• Examine network topologies, data flows, trust boundaries, and potential choke points to inform hunt and response activities.
• Assess network topology and device configurations, identify security concerns, and recommend security best practices, particularly for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
• Determine appropriate responses to anomalous network activity, including containment, eradication, and hardening.
• Apply defense-in-depth principles and knowledge of attack stages to evaluate and improve network security architecture and edge-device configurations.
• Validate network device state, detect unauthorized modifications, and recommend remediation using device integrity concepts and methodologies.
• Lead analysis of logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
• Provide expert analysis and research on complex hunt and incident response problems with broad direction.
• Provide technical direction, interpretation, and alternatives to high-level incident response teams handling network-centric incidents.
• Independently determine technical objectives and develop solutions to complex problems.
• Recommend targeted mitigations based on incident data and victim environments, including network segmentation, policy updates, and device hardening.
• Advise technical personnel on implementing and customizing countermeasures such as firewall rules, IPS signatures, and access control lists.
• Support internal stakeholders on containment and eradication missions, onsite and remotely.
• Preserve evidence integrity according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
• Assist in writing and publishing Computer Network Defense (CND) guidance and detailed incident reports.
• Prepare executive summaries and detailed technical reports for leadership and technical audiences.
• Document analysis, TTPs, and device-specific incident handling procedures in a standardized knowledge base.
• Assist in maintaining branch process and procedure documentation and guides for hunt and incident response activities.

Benefits

• Extremely competitive salary.
• 95% employer-paid employee medical, dental, and vision coverage.
• 100% employer-paid employee life, short-term disability, and long-term disability coverage.
• 401(k) with company match.
• Flexible Spending Account for dependent and health care.
• 11 standard holidays and 3 weeks of annual leave.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior