DFIR Analyst: Incident Response, Forensics & Threat Hunting

VTG Defense; Herndon (VA); On-site; USD 130,000 - 240,000; Full time

Job summary

VTG Defense in Herndon, VA is seeking a DFIR Analyst to lead detection, containment, and forensic investigation of complex cybersecurity incidents. This role focuses on securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes.

The DFIR Analyst acts as a core responder to active threats, translating indicators of compromise into tactical actions and enterprise countermeasures, with DoD 8570 IAT II compliance and TS/SCI with

Qualifications

• 11+ years in cyber security with government programs.
• 2+ years in host/network forensics, threat hunting, or Tier 3 incident response.
• Proficient with forensic suites and EDR/XDR platforms.

Responsibilities

• Perform live memory analysis and disk imaging with strict chain-of-custody.
• Analyze logs to map attacker movement and build incident timelines.
• Coordinate threat containment and remediation with customers.
• Develop detailed forensic reports and root-cause analyses.
• Advise customers on vulnerabilities and threat trends.

Skills

Cyber Security

Host Forensics

Threat Hunting

Incident Response

Communications

DoD 8570 IAT II

Education

Bachelor’s degree in digital forensics or cybersecurity

Tools

Axiom

X-Ways

FTK

EnCase

Volatility

KAPE

EDR/XDR platforms

Job description

VTG Defense in Herndon, VA is seeking a DFIR Analyst to lead detection, containment, and forensic investigation of complex cybersecurity incidents. This role focuses on securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes.

The DFIR Analyst acts as a core responder to active threats, translating indicators of compromise into tactical actions and enterprise countermeasures, with DoD 8570 IAT II compliance and TS/SCI with