DFIR Lead: Intrusion Analysis & Incident Response

Spry Methods, Inc.; Linthicum (MD); On-site; USD 200,000 - 225,000; Full time

Job summary

Spry Methods, Inc. seeks a Digital Forensics and Incident Response (DFIR) Lead to direct all DFIR activities at a government digital forensics laboratory.

This role manages intrusion analysis and incident response staff, providing technical oversight for investigations across multiple data sources. Requirements include TS/SCI eligibility, GCFA or GCIH certification, 7+ years in DFIR (5+ in network intrusion analysis and memory forensics), 3+ years in leadership, and prior experience briefing

Qualifications

• Active TS/SCI clearance eligibility
• GCFA or GCIH certification required
• 7+ years in Digital Forensics and Incident Response, 5+ years in network intrusion analysis and memory forensics
• 3+ years of leadership or supervisory experience in intrusion investigations
• Experience analyzing advanced persistent threat activity and correlating findings across sources

Responsibilities

• Lead CFL Digital Forensics and Incident Response activities.
• Manage intrusion analysis and incident response personnel.
• Direct network intrusion analysis, malware forensics, and memory analysis.
• Lead intrusion investigations and monitor quality and efficiency.
• Analyze advanced persistent threat activity and correlate findings from multiple sources.
• Brief technical findings to Government leadership.
• Ensure all activities comply with the PWS.
• Serve as the primary Government technical POC for intrusion analysis and incident response.

Skills

DFIR

Leadership

Network analysis

Malware forensics

Memory analysis

Threat intel

Clearance eligible

GCFA

GCIH

TS/SCI eligible

Job description

Spry Methods, Inc. seeks a Digital Forensics and Incident Response (DFIR) Lead to direct all DFIR activities at a government digital forensics laboratory.

This role manages intrusion analysis and incident response staff, providing technical oversight for investigations across multiple data sources. Requirements include TS/SCI eligibility, GCFA or GCIH certification, 7+ years in DFIR (5+ in network intrusion analysis and memory forensics), 3+ years in leadership, and prior experience briefing