Digital Forensics Analyst

ManTech; Herndon (VA); On-site; USD 120,000 - 150,000; Full time

Job summary

MANTECH in Herndon, VA seeks a Digital Forensics Analyst to lead incident detection, containment, and forensic investigations across enterprise environments. You will secure volatile evidence, reconstruct attack timelines, and translate indicators into actionable remediation steps for customers.

The role requires DoD 8570 IAT II certification, 7+ years in cybersecurity, and hands-on experience with forensic tools and EDR/XDR platforms. A TS/SCI clearance is preferred.

Qualifications

• 7+ years of experience in Cybersecurity.
• 2+ years of experience in host/network forensics, threat hunting, or Tier 3 cybersecurity incident response.
• 2+ years of experience with forensic suites (e.g., Magnet AXIOM, X-Ways, FTK, EnCase, Volatility, or KAPE) and EDR/XDR platforms.
• 2+ years of experience analyzing host artifacts (e.g., MFT, Registry, Event Logs), volatile memory, and PCAPs to reconstruct cyber attacks.
• Active DoD 8570 IAT Level II (or higher) certification is required.

Responsibilities

• Perform live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints with strict chain-of-custody.
• Analyze endpoint, cloud, and system log data to map threat actor movement, build incident timelines, and isolate IOCs.
• Coordinate immediate threat containment and eradication strategies with the customer and affected end users.
• Conduct proactive and reactive threat hunting to uncover APTs and persistence mechanisms.
• Prepare detailed forensic reports and root-cause analyses to justify remediation and network modifications.
• Collaborate with cyber defense teams to deploy tactical updates and enterprise countermeasures post-incident.
• Identify gaps in logging, visibility, and architectures, providing actionable recommendations to mature monitoring.
• Advise customer on technical impacts, zero-day vulnerabilities, and threat trends.

Skills

Cybersecurity

Threat hunting

Forensics

EDR/XDR

Memory analysis

Network forensics

DoD 8570 IAT II cert

Education

Bachelor's degree in Digital Forensics or related

Tools

Magnet AXIOM

X-Ways

FTK

EnCase

Volatility

KAPE

Job description

MANTECH seeks a motivated, career- and customer-oriented Digital Forensics Analyst to join our team in Herndon, VA . In this role, you will lead the detection, containment, and forensic investigation of complex cybersecurity incidents within the organization. Acting as a core responder to active threats, you will secure volatile evidence, analyze host and network telemetry, and reconstruct attack timelines to identify root causes, bridging technical forensics with risk mitigation by translating complex indicators of compromise into tactical response actions and enterprise countermeasures.

Responsibilities include, but are not limited to:

• Perform live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints while maintaining strict chain-of-custody protocols.

• Analyze endpoint, cloud, and system log data to map threat actor movement, build comprehensive incident timelines, and isolate indicators of compromise (IOCs).

• Communicate with the customer and affected end users to coordinate immediate threat containment and eradication strategies.

• Conduct proactive and reactive threat hunting across the network to uncover advanced persistent threats (APTs) and hidden persistence mechanisms.

• Prepare detailed technical forensic reports and root-cause analyses to justify Incident Response remediation, recovery plans, and network modifications.

• Collaborate with cyber defense teams to deploy tactical signature updates, endpoint rules, and enterprise-wide countermeasures post-incident.

• Identify gaps in current logging, visibility, and logging architectures, providing actionable engineering recommendations to mature continuous monitoring capabilities.

• Advise the customer on technical impacts, zero-day vulnerabilities, and threat trends affecting organizational equities.

Minimum Qualifications:

• 7+ years of experience in Cybersecurity

• 2+ years of experience in host/network forensics, threat hunting, or Tier 3 cybersecurity incident response

• 2+ years of experience with commercial and open-source forensic suites (e.g., Magnet AXIOM, X-Ways, FTK, EnCase, Volatility, or KAPE) and Enterprise Detection & Response (EDR/XDR) platforms

• 2+ years of experience analyzing host artifacts (e.g., MFT, Registry, Event Logs), volatile memory, and network packet captures (PCAP) to reconstruct cyber attacks

• Must possess an active DoD 8570 IAT Level II (or higher) certification (CompTIA Security+, SSCP, CySA+, GSEC, GICSP, CCNA Security, CND v3, RHCSA, CISSP (or Associate), CISA, CompTIA Advanced Security Practitioner/SecurityX, CCNP Security, CCSP, GCIH, or GCED)

Preferred Qualifications:

• Bachelor’s degree in Digital Forensics, Cybersecurity, Computer Engineering, Computer Science, or a closely related IT discipline.

Security Clearance Requirements:

• Must have a current/active TS/SCI clearance with Polygraph.

Physical Requirements:

• Must be able to remain in a stationary position 50% of the time.

MANTECH International Corporation considers all qualified applicants for employment without regard to disability or veteran status or any other status protected under any federal, state, or local law or regulation.

If you need a reasonable accommodation to apply for a position with MANTECH, please email us at [e-mail] and provide your name and contact information.