Senior Digital Forensics Incident Response Analyst (DoD TS/SCI Clearance)

MartinFed • Redstone Arsenal, AL

1d • Onsite

About The Position

MartinFed has an opening for a Senior Digital Forensics Incident Response Analyst to join our team of talented and diverse individuals. The Digital Forensics Incident Response Analyst provides identification, collection, examination, and analysis of data in support of incident response activities. These investigations include policy violations, incident reconstruction, and malware analysis to support internal incident response along with counterintelligence and law enforcement activities.

Requirements

• US Citizen with a Top Secret Clearance w/ SCI Elgibility.
• Bachelor's Degree in Computer Science or related technical field.
• 7-9 years' progressive work experience within Information Security.
• At least 3 years' experience related to DFIR, SOC, or LEO DF Unit.
• At least 2 years' experience with technical writing, developing technical documents, and incident response reporting.
• Holds an intermediate level, industry recognized, certification (GCIH/GCFE/GCFA/GNFA//GREM/CFCE/CAWFE/EnCE/CCE).
• Strong experience with Unix/Linux system administration.
• Strong experience with Windows system administration.
• Strong experience analyzing various log formats such as those from endpoints, networking devices, and authentication services.
• Experience with forensic tooling (AXIOM, FTK, Arsenal Recon, Zimmerman Tools, X-Ways, Ghidra, IDA, Volatility, etc).
• Knowledge of common host-based forensic artifacts in multiple operating systems.
• Understanding of network architecture, common network protocols, and how threat actors can abuse them.
• Experience with cloud-based investigations, including Amazon AWS and Microsoft Azure.
• Experience with static/dynamic malware analysis.
• Strong scripting capabilities (Python, PowerShell, Bash, Shell).
• Knowledge of incident response methodologies and technologies.
• Understanding of current industry trends and emerging threats.
• Experience collaborating with dozens of different teams across a large and diverse environment.
• Strong oral, written, and presentation abilities.

Nice To Haves

• Master's Degree in Computer Science or related technical field.
• Deep knowledge related to the functionality of Windows OS, Mac OS-X, and Linux Operating systems and associated file systems (NTFS, HFS, ext, exFAT, etc).
• Knowledge of Windows based memory forensics, including internal structure, and what data can be recovered.
• Experience with analyzing raw packet capture.

Responsibilities

• Lead and conduct real-time and historical analysis using security analytics tools and digital forensics tool suites.
• Perform initial incident triage, forensic imaging, host and network analysis.
• Determine attacker activity on known compromised systems (Intrusion vector, privilege escalation, lateral movement, malware deployment, exfiltration, etc).
• Discover, characterize, and assess anomalous network and platform activity on various information systems and networks.
• Conduct memory analysis to recover crucial case artifacts.
• Engage in static and dynamic malware analysis to determine its functionality.
• Research and leverage cybersecurity intelligence sources to improve SOC incident detection and response capabilities.
• Develop, manage, and maintain a forensic laboratory, including specialized hardware and software products.
• Collaborate and coordinate with other customer organizations, including but not limited to the network operations, system administrators and ISSOs, as needed in support of all service activities.
• Assist the Government with oversight and coordination for response to significant cyber incidents.
• Produce and present analytics, case review, and incident reporting to the Information Security community and Government leadership.
• Provide post-incident recommendations to improve cybersecurity posture.
• Ability to travel, on short notice, to facilities to support incident response.
• Develop and maintain SOPs regarding data collection, forensic examination, reporting and investigations, in support of operational requirements.

Benefits

• customer-focused, performance-based solutions using technology and an empowered workforce as an engine to drive its customers' missions.
• We invest in our people because they are our greatest asset.
• They cultivate our purpose, embody and reflect our core values, and define our culture.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior