Senior Host Based Cyber Systems Analyst

Argo Cyber Systems•Arlington, VA

25d•$120,000 - $140,000•Onsite

About The Position

ARGO Cyber Systems is seeking an experienced Senior Host Forensics Analyst to support a critical federal customer mission. The role provides technical expertise to federal leads and forensic teams during onsite engagements, supporting the collection, preservation, examination, analysis, and reporting of digital evidence. It requires investigative judgment, attention to forensic integrity, strong technical writing, and the ability to communicate complex findings to technical and executive stakeholders. The position requires an active TS/SCI clearance, U.S. citizenship, and the ability to obtain DHS Suitability. Extensive travel to incident response locations throughout the United States, U.S. Territories, and Possessions is required.

Requirements

U.S. citizenship.
Active TS/SCI security clearance.
Ability to obtain DHS Suitability.
Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline; alternatively, a high school diploma or GED with 10 or more years of host or digital forensics experience.
At least 8 years of directly relevant experience conducting cyber forensic investigations using industry-standard forensic tools and leading-edge technologies.
Demonstrated experience conducting host-based and/or digital forensic investigations.
Experience creating forensically sound duplicates and forensic images of computer systems.
Ability to produce comprehensive cyber investigative reports documenting digital forensic findings.
Experience analyzing and characterizing cyber attacks and related digital evidence.
Knowledge of digital asset collection, preservation, handling, and chain-of-custody procedures.
Ability to identify different classes of cyber attacks and stages of compromise.
Knowledge of system and application security threats, vulnerabilities, and attack methodologies.
Knowledge and experience conducting proactive analysis of systems and networks, including establishing trust levels for critical resources.
Strong technical writing, analytical, communication, and presentation skills.
Ability to work collaboratively with geographically dispersed teams and stakeholders.
Ability and willingness to travel extensively for onsite incident response engagements.

Nice To Haves

Experience with EnCase.
Experience with SIFT.
Experience with X-Ways.
Experience with Volatility.
Experience with Wireshark.
Experience with Sleuth Kit / Autopsy.
Experience with Magnet AXIOM Cyber.
Experience with Snort.
Experience with Splunk or other SIEM platforms, including ArcSight, LogRhythm, Elastic, or similar.
Experience with EDR platforms, including CrowdStrike, Microsoft Defender for Endpoint (MDE), Trellix, or similar technologies.
Experience with other industry-standard digital forensics, incident response, SIEM, EDR, or security analysis tools.
GIAC Certified Forensic Analyst (GCFA).
GIAC Certified Forensic Examiner (GCFE).
EnCase Certified Examiner (EnCE).
Certified Computer Examiner (CCE).
Certified Forensic Computer Examiner (CFCE).
Certified Information Systems Security Professional (CISSP).

Responsibilities

Assist federal leads with overseeing and leading forensic teams during onsite engagements, including coordinating data collection and acquisition operations.
Provide technical guidance on data collection methods, digital forensic procedures, and investigative techniques.
Plan, coordinate, and direct the inventory, examination, and technical analysis of computer systems, hosts, and digital artifacts.
Create and maintain forensically sound duplicates and images of computer systems and digital evidence.
Support forensic analysis and mentor junior personnel on data collection, evidence analysis, investigative methodologies, and technical reporting.
Assist with leading and coordinating forensic teams during preliminary investigations and onsite incident response engagements.
Analyze digital evidence to identify indicators of compromise, malicious activity, attack vectors, persistence mechanisms, and other cyber incident artifacts.
Evaluate, extract, and analyze suspected malicious code and related artifacts.
Analyze and characterize cyber attacks, including attack classes, stages of compromise, tactics, techniques, and procedures.
Ensure proper digital evidence collection, preservation, documentation, and chain-of-custody procedures.
Write comprehensive technical reports documenting forensic findings, methodologies, analysis, and conclusions.
Distill analytic findings into executive summaries and detailed technical reports for leadership and stakeholders.
Conduct peer reviews and quality assurance reviews of forensic products and reports, particularly those prepared by junior personnel.
Serve as a technical forensics liaison to customers and stakeholders, explaining findings, methodologies, protocols, and supporting evidence.
Track and document onsite incident response activities and provide regular status updates to federal leadership.
Conduct proactive analysis of systems and networks, including evaluating and establishing trust levels for critical resources.
Collaborate with forensic, cybersecurity, incident response, and customer teams across multiple physical locations.
Travel to incident response locations throughout the United States, U.S. Territories, and Possessions as required.