Cyber Investigations Analyst - OTA / Active Top Secret

Peraton; Virginia; Hybrid; USD 90,000 - 150,000; Full time

Job summary

Peraton is seeking a Cyber Investigations Analyst to join the Federal Strategic Cyber Group. Located in Rosslyn, VA, this full-time role offers a hybrid schedule after 90 days.

You will support insider threat investigations using user activity monitoring tools, analyze logs, and develop detection rules to protect enterprise systems. The ideal candidate has a bachelor's degree with several years of cybersecurity or digital forensics experience, a Security+ CE certification, excellent reporting

Qualifications

• Bachelor’s degree with 5 years of experience; 4 years may substitute for the degree.
• Minimum 2 years experience in cybersecurity, digital forensics, or cyber investigations.
• Must possess or obtain Security+ CE before start date.
• Experience conducting insider threat investigations in an enterprise environment.
• Experience analyzing large datasets of user activity, log data, and endpoint telemetry.
• Excellent written and verbal communication, including formal investigative reports.
• U.S. citizenship required and Active Top Secret security clearance; ability to obtain TS/SCI if needed.

Responsibilities

• Support CTAD in end-to-end insider threat and cyber investigations using UAM data.
• Collect, analyze, and interpret log data to detect anomalous user behavior and policy violations.
• Develop and refine detection rules, alerts, and behavioral baselines.
• Conduct forensic analysis of logs, endpoint telemetry, and network data to support investigations.
• Communicate findings to technical and non-technical stakeholders, including senior management.
• Collaborate with legal, HR, and security to ensure compliant investigations.
• Author detailed investigation reports, bulletins, and advisories.

Skills

Cybersecurity experience

Digital forensics

Insider threat investigations

Data analysis

Communication skills

Education

Bachelor's degree

Security+ CE

Tools

Splunk

Microsoft Sentinel

EnCase

FTK

Azure AD

Job description

Minimum requirements:

• A Bachelor’s degree and 5 years of experience. An additional 4 years of experience may be substituted in lieu of the bachelors degree requirement.
• Minimum of 2 years experience in cybersecurity, digital forensics, or cyber investigations.
• Must either possess and maintain, or obtain prior to start date, one of the following professional certifications:
  • Security+ CE
• Experience conducting insider threat or cyber misconduct investigations in an enterprise environment.
• Experience analyzing large datasets of user activity, log data, and endpoint telemetry.
• Strong analytical, problem-solving, and decision-making skills to support complex, sensitive investigations.
• Excellent written and verbal communication skills, including experience producing formal investigative reports.
• Must possess strong time management skills and the ability to complete assigned tasks with minimal supervision.
• U.S. citizenship required.
• Active Top Secret security clearance.
  • Ability to obtain a final Top Secret/SCI security clearance.

Desired:

• Experience with insider threat programs and familiarity with the National Insider Threat Policy.
• Familiarity with SIEM platforms (e.g., Splunk, Microsoft Sentinel) for correlating UAM data with broader security telemetry.
• Experience with digital forensics tools (e.g., EnCase, FTK, Magnet AXIOM).
• Knowledge of Active Directory and Azure AD for user account analysis.
• Experience working in a government or federal law enforcement investigative environment.
• Technical writing skills and experience producing materials for senior leadership audiences.
• Familiarity with chain of custody procedures, and eDiscovery processes.
• Experience with behavioral analytics platforms or UEBA (User and Entity Behavior Analytics) tools.

Peraton is looking for a Cyber Investigations Analystto become part of our Federal Strategic Cyber Group.

Location: Rosslyn, VA; full-time, hybrid schedule may be an option after 90 days.

In this role, you will:

• Support the Cyber Threat Investigations & Analysis Division (CTAD) in conducting end-to-end insider threat and cyber investigations leveraging User Activity Monitoring (UAM) tools and data.
• Collect, analyze, and interpret log data to detect anomalous user behavior, policy violations, and potential insider threats across enterprise systems.
• Develop and refine detection rules, alerts, and behavioral baselines to improve threat detection capabilities.
• Conduct forensic analysis of user activity logs, endpoint telemetry, and network data to support investigations and produce actionable intelligence.
• Communicate complex investigative findings to both technical and non-technical stakeholders, including senior management.
• Collaborate with legal, HR, and security teams to ensure investigations are conducted in accordance with applicable laws, policies, and Department guidelines.
• Author detailed investigation reports, bulletins, and advisories documenting findings.
• Promote awareness of insider threat indicators and UAM best practices among customer stakeholders, coworkers, and Department users.
• Respond to escalated security incidents and provide expert guidance on user activity-related threat vectors.
• Manage case documentation and investigative records in SharePoint repositories.
• Provide guidance and mentorship to junior team members on investigative techniques and tool usage.
• Stay current on emerging insider threat tactics, techniques, and procedures (TTPs) and incorporate findings into detection strategies.