Senior Cyber Forensic Analyst

ShorePoint•Albuquerque, NM

3d•Onsite

About The Position

ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a “work hard, play hard” mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market. Employment for this position is dependent on the successful award of the contract. for a potential opportunity

Requirements

Digital forensic investigations and incident response within complex federal, national-security or other highly regulated environments.
Host-, network- and log-based forensic analysis, attack-timeline reconstruction, evidence preservation, chain of custody, forensic imaging and collection, artifact analysis, log correlation, malware triage and incident documentation practices.
Security information and event management (SIEM), endpoint detection and response (EDR), network-security monitoring, forensic-analysis tools and threat-intelligence sources.
Incident-response lifecycle practices, threat hunting, vulnerability analysis, continuous monitoring and control-effectiveness validation.
Cybersecurity risk management, federal security controls, continuous monitoring and the relationship between operational findings and authorization or POA&M activities.
Development of concise, defensible reports, evidence packages and corrective-action recommendations under time-sensitive conditions, including communicating findings to technical and nontechnical stakeholders and coordinating with government stakeholders, ISSOs, security operations personnel and Federal technical authorities.
Bachelor’s degree from an accredited university; a postgraduate degree from an accredited university may substitute for 6 years of experience.
10+ years of relevant work experience.
Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
Applicants must currently be a U.S. citizen and eligible to obtain and maintain a security clearance, in compliance with federal contract requirements.

Nice To Haves

Active DOE Q or equivalent DoD Top Secret clearance.

Responsibilities

Lead and perform advanced digital forensic examinations involving endpoint, server, network, cloud, application, removable-media and log-data sources in support of suspected or confirmed cybersecurity incidents.
Collect, preserve, validate, analyze and document digital evidence using sound forensic practices while maintaining evidentiary integrity, chain-of-custody records and reproducible analysis methods.
Reconstruct incident timelines and identify initial access, attacker activity, persistence, lateral movement, data access or exfiltration indicators, affected assets and potential mission or system impacts.
Lead forensic support for complex incident response activities, including scoping, triage, containment recommendations, eradication and recovery validation, post-incident reporting and lessons learned.
Conduct proactive threat-hunting activities using endpoint, network, identity and security-event data and develop and refine hypotheses based on threat intelligence, observed behaviors and environmental risk.
Analyze security alerts, logs, malware artifacts, suspicious files, authentication events and network activity to identify indicators of compromise, tactics, techniques and procedures and detection or monitoring gaps.
Produce clear technical reports, executive-ready summaries, evidence packages, incident timelines, hunt reports and recommended corrective actions for cybersecurity leadership, government stakeholders, ISSOs, Federal Information Systems Security Engineers (ISSEs) and other authorized personnel.
Coordinate with ISSOs to ensure relevant incident, forensic, vulnerability and monitoring findings are reflected in risk assessments, security documentation, continuous-monitoring artifacts, authorization evidence and Plans of Action and Milestones (POA&M) records.
Support vulnerability assessment and defensive-exercise activities by analyzing results, validating operational impact, identifying detection and response gaps and documenting corrective-action recommendations.
Contribute to continuous-monitoring, incident, hunting, detection-effectiveness and capability-gap metrics, identify recurring trends and recommend process or detection improvements.
Develop and maintain forensic playbooks, standard operating procedures, evidence-handling processes and analytical work instructions consistent with customer, program and legal requirements.
Mentor cyber analysts and contribute to an integrated, repeatable and measurable cyber-defense operating model.