Cloud Analyst

Forensic Focus; McLean (VA); On-site; USD 90,000 - 130,000; Full time

Job summary

Booz Allen Hamilton in McLean, VA is seeking a Cloud Analyst to investigate Business Email Compromise incidents by collecting and analyzing logs from cloud platforms such as Microsoft 365, correlating evidence across sources, building timelines, and presenting findings to clients under time-sensitive conditions.

The role emphasizes independent work on cloud/email investigations and clear communication of technical findings to non-technical stakeholders.

Qualifications

• Experience with forensic artifacts and PowerShell-based BEC tools.
• Log analysis across Microsoft 365, Exchange, and Google Workspace.
• Familiarity with cloud forensics on AWS, Azure, and GCP; email header analysis is a plus.
• Certifications such as GCFE, GCFA, or CISSP are advantageous.

Responsibilities

• Investigate Business Email Compromise incidents by collecting and analyzing cloud logs, correlating evidence, and building timelines.
• Present findings to clients verbally and in written reports, often under time-sensitive conditions.

Skills

Cloud forensics

Log analysis

PowerShell

M365 forensics

Email header analysis

Forensic artifacts

Tools

EnCase

FTK Axiom

Splunk

Job description

# Cloud Analyst*Booz Allen Hamilton***McLean, VA**Onsite · Mid · Full-time### The RoleThis position involves investigating Business Email Compromise incidents by collecting and analyzing logs from cloud platforms such as Microsoft 365, correlating evidence across sources, building timelines, and presenting findings to clients both verbally and in written reports, often under time-sensitive conditions.### Skills & ExperienceRequires knowledge of forensic artifacts, PowerShell-based BEC toolsets, and log analysis across M365, Exchange, or Google Workspace. Familiarity with AWS, Azure, GCP forensics, email header analysis, and tools like EnCase, FTK Axiom, Splunk is advantageous, alongside certifications such as GCFE, GCFA, or CISSP.### Who It SuitsSuited to forensic analysts comfortable working independently on cloud and email investigations, who can manage multiple cases, work flexible or on-call hours, and communicate technical findings clearly to non-technical stakeholders.