Cyber Network Forensics Analyst – Onsite Incident Response

Nightwing; Virginia; On-site; USD 77,000 - 163,000; Full time

Benefits offered by this job

Medical insurance

Vision insurance

Dental insurance

401k plan

Paid time off

Job summary

Nightwing is seeking a Network Forensics Analyst to support onsite incident response for a U.S. Government customer in Arlington, VA. You will investigate and remediate cyber incidents, coordinate with the government lead, and provide actionable guidance on security best practices.

The role requires active TS/SCI clearance, 5+ years in network investigations, and strong knowledge of CND policies, TCP/IP, and SIEM tools. Travel to support onsite engagements may be required.

Qualifications

• Must be a U.S. citizen with an active TS/SCI clearance.
• 5+ years of directly relevant experience in network investigations.
• In-depth knowledge of CND policies, procedures and regulations.
• In-depth knowledge of TCP/IP protocols.
• In-depth knowledge of standard protocols – ICMP, HTTP/S, DNS, SSH, SMTP, SMB, NFS, etc.
• In-depth knowledge and experience of WiFi networking.
• In-depth knowledge and experience of network topologies.
• Substantial knowledge of Splunk (or other SIEMs).
• Understanding of MITRE Adversary Tactics, Techniques and Common Knowledge (ATT&CK).
• Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture.

Responsibilities

• Assists the Government lead in coordinating teams in preliminary incident response investigations.
• Assists the Government lead with interfacing with the customer while on site.
• Determines appropriate courses of actions in response to identified and analyzed anomalous network activity.
• Assesses network topology and device configurations identifying critical security concerns and providing security best practice recommendations.
• Assists with the writing and publishing of Computer Network Defense guidance and reports on incident findings to appropriate constituencies.
• Collects network intrusion artifacts (e.g., PCAP, domains, URI’s, certificates) and uses data to enable mitigation of incidents.
• Analyzes identified malicious network activity to determine weaknesses exploited and effects on systems.
• Collects network device integrity data and analyzes for signs of tampering or compromise.
• Assists with real-time CND incident handling tasks to support onsite engagements.

Skills

U.S. Citizenship

TS/SCI clearance

TCP/IP

HTTP/S

DNS

SSH

SMB

NFS

WiFi networking

Network topologies

Splunk

ATT&CK

CND policies

Network traffic analysis

PCAP analysis

SIEM proficiency

Education

BS in Computer Science/Cyber Security/CE

HS Diploma + 7–9 years experience

Tools

Wireshark

Job description

Nightwing is seeking a Network Forensics Analyst to support onsite incident response for a U.S. Government customer in Arlington, VA. You will investigate and remediate cyber incidents, coordinate with the government lead, and provide actionable guidance on security best practices.

The role requires active TS/SCI clearance, 5+ years in network investigations, and strong knowledge of CND policies, TCP/IP, and SIEM tools. Travel to support onsite engagements may be required.