Cyber Forensic Specialist

Accenture; Arlington (VA); On-site; USD 90,000 - 120,000; Full time

Job summary

Accenture Federal Services is seeking a skilled Cyber Forensic Specialist to join the DFIR team. The role involves supporting incident response, conducting digital forensic investigations on diverse devices and cloud systems, and collaborating with HR, Legal, and Insider Threat to handle internal investigations and evidence management.

You will work with EnCase, FTK, X-Ways, and Magnet AXIOM to process evidence, prepare detailed reports, and ensure proper chain of custody for litigation holds

Qualifications

• 3-5 years of information security experience.
• 3+ years of performing digital forensics on physical and cloud systems.
• 2+ years of event and log analysis across security tools (AV, IDS, Firewalls, AD, proxies, DLP) and SIEM.

Responsibilities

• DFIR support: investigate and respond to cybersecurity incidents (malware, data breaches, APTs).
• Perform digital forensic analysis on devices and network logs to identify root causes and scope.
• Partner with Legal for litigation holds and eDiscovery; maintain evidence custody and documentation.
• Provide guidance and training on forensic processes to internal teams and external partners.

Skills

DFIR

Digital Forensics

Incident Response

Evidence Handling

eDiscovery

Communication

Tools

EnCase

FTK

X-Ways

Magnet AXIOM

Job description

At Accenture Federal Services, nothing matters more than helping the US federal government make the nation stronger and safer and life better for people.Our 13,000+ people are united in a shared purpose to pursue the limitless potential of technology and ingenuity for clients across defense, national security, public safety, civilian, and military health organizations.

Join Accenture Federal Services, a technology company within global Accenture. Recognized as a Glassdoor Top 100 Best Place to Work, we offer a collaborative and caring community where you feel like you belong and are empowered to grow, learn and thrive through hands-on experience, certifications, industry training and more.

Join us to drive positive, lasting change that moves missions and the government forward!

We are seeking a skilled and detail-oriented Cyber Forensic Specialist to join our Digital Forensics and Incident Response (DFIR) team. This role is critical in supporting the organization's Cyber Incident Response Team (CIRT) by providing expert-level digital forensic and investigative support. Additionally, the position involves working closely with cross-functional teams, including Human Resources, Legal, and Insider Threat, to conduct sensitive internal investigations related to policy adherence and organizational concerns.

The Cyber Forensic Specialist will also collaborate with the internal Legal team to execute litigation holds and eDiscovery-related evidence captures, ensuring full compliance with organizational and regulatory requirements. The role further involves serving as the central point for evidence intake, processing, and management for cases, litigation holds, and investigations.

The Work

1. DFIR Support :
2. Collaborate with the Cyber Incident Response Team (CIRT) to investigate and respond to cybersecurity incidents, including malware infections, unauthorized access, data breaches, and advanced persistent threats (APTs).
3. Perform digital forensic analysis on devices such as laptops, desktops, servers, mobile devices, and network logs to identify the root cause and scope of incidents.
4. Provide recommendations on containment, remediation, and recovery activities.
5. Investigative Support :
6. Conduct internal investigations in collaboration with HR, Legal, and Insider Threat teams related to:
7. Potential risks to organizational assets and operations.
8. Inquiries requiring the collection and analysis of electronic evidence.
9. Other internal matters involving digital investigations.
10. Analyze electronic communications, file systems, and digital artifacts to uncover evidence.
11. Prepare detailed, well-documented reports and findings to support decision-making and potential actions.
12. Litigation Holds and eDiscovery :
13. Partner with the Legal team to ensure the timely and accurate implementation of litigation holds, including identifying, preserving, and collecting electronically stored information (ESI).
14. Perform eDiscovery-related data captures, including on-premises and cloud-based systems, in alignment with legal and regulatory requirements.
15. Maintain thorough documentation of all eDiscovery activities for legal proceedings and audits.
16. Evidence Intake and Management :
17. Serve as the central point for evidence intake, ensuring proper chain of custody and documentation for all collected digital evidence.
18. Maintain and enforce evidence management protocols, including secure storage, tagging, and tracking for litigation holds and legal proceedings.
19. Ensure compliance with data retention and destruction policies.
20. Process Optimization and Tooling :
21. Leverage forensic tools (e.g., EnCase, FTK, X-Ways, Magnet Axiom) to analyze and process evidence efficiently.
22. Continuously improve and document forensic methodologies, workflows, and playbooks.
23. Stay up to date with emerging forensic techniques, tools, and industry best practices.
24. Collaboration and Training :
25. Provide guidance and training to the CIRT and other internal teams on forensic processes and evidence handling.
26. Collaborate with outside counsel or external third-party forensic services, when required.

What you need

• US Citizenship required.
• 3-5 years of experience in information security, or other equivalent combination of education or equivalent work experience.
• 3 + years of experience with performing digital forensics on physical and cloud systems.
• 2+ years of experience performing event and log analysis including one or more of the following: Anti-Virus, Intrusion Detection Systems, Firewalls, Active Directory, Web Proxies, Data loss prevention tools and other security tools found in large enterprise network environments; along with experience working with Security Information and Event Management (SIEM) solutions.
• 1+ years of experience investigating, containing, eradicating, and preventing current and future compromises i.e., implementing or requesting an IP/domain/URL block, file hash block, email purge, software removal, device reimage, etc.
• 1+ years of experience with collecting, processing, reviewing, and producing