Digital Forensics Analyst- HYBRID

Crest Security Assurance; Alexandria (VA); Hybrid; USD 120,000 - 165,000; Full time

Job summary

Crest Security Assurance seeks a Senior Digital Forensics Investigator to drive forensics across endpoints, networks, and cloud environments. You will acquire and analyze evidence, perform malware analysis, and support containment and remediation with incident response teams.

The role requires 5+ years of DFIR experience, strong tooling knowledge, and collaboration with IR, SOC, legal, and government stakeholders. Hybrid role in Alexandria, VA.

Qualifications

• Bachelor's degree in Cybersecurity, Digital Forensics, CS, IT, or related field.
• 5+ years of hands-on DFIR experience.
• Experience with imaging, memory analysis, evidence preservation, and chain-of-custody.
• Proficiency investigating Windows, Linux, M365, Azure, and AWS.
• Hands-on with forensic tools, SIEMs, EDR/XDR, and network traffic analysis.
• Strong knowledge of MITRE ATT&CK and investigative reporting.

Responsibilities

• Conduct digital forensic investigations on endpoints, servers, networks, cloud services to identify evidence.
• Acquire, preserve, and analyze digital evidence including disk images, memory captures, logs.
• Use EnCase, FTK, Autopsy, Volatility, Magnet AXIOM to collect and analyze evidence.
• Perform malware analysis including static/dynamic analysis and IOC identification.
• Investigate ransomware, credential theft, insider threats, exfiltration and APT activity.
• Analyze artifacts across Windows, Linux, AD, M365, Azure, AWS to reconstruct timelines.
• Analyze endpoint telemetry, SIEM alerts, EDR/XDR data, network captures using Splunk, Wireshark.
• Support threat hunting and IOC analysis using MITRE ATT&CK.
• Support incident response with evidence, attack-path reconstruction, and remediation guidance.
• Investigate insider threats and data leakage while maintaining confidentiality.
• Maintain chain-of-custody, secure storage, and repeatable procedures per NIST SP 800-86 and federal requirements.
• Develop forensic SOPs, playbooks, and evidence collection methodologies.
• Prepare detailed forensic reports with methods, timelines, findings, impacts and actions.
• Coordinate with IR, SOC, threat intel, legal, privacy, and government stakeholders.

Skills

Digital forensics

Incident investigation

Evidence preservation

MITRE ATT&CK

Network traffic analysis

Windows/Linux

Education

Bachelor's degree

Tools

EnCase

FTK

Autopsy

Volatility

Magnet AXIOM

Splunk

Wireshark

Microsoft Defender

Job description

Conducts advanced digital forensic investigations, malware analysis, and forensic evidence collection across enterprise networks, endpoints, and cloud environments. Supports cybersecurity incident response, insider threat investigations, and threat hunting by identifying malicious activity, reconstructing attack timelines, and determining the scope and impact of security incidents.

Key Responsibilities

• Conduct digital forensic investigations involving compromised endpoints, servers, networks, cloud services, and enterprise applications to identify evidence of malicious or unauthorized activity.
• Acquire, preserve, and analyze digital evidence, including disk images, memory captures, system artifacts, event logs, network traffic, and cloud audit records.
• Utilize forensic tools such as EnCase, FTK, Autopsy, Volatility, Magnet AXIOM, and other approved platforms to conduct evidence collection, examination, and analysis.
• Perform malware analysis, including static and dynamic analysis, behavioral examination, sandbox execution, and reverse engineering to identify malicious functionality and indicators of compromise (IOCs).
• Investigate ransomware, credential theft, unauthorized access, insider threats, data exfiltration, lateral movement, and advanced persistent threat (APT) activity.
• Analyze Windows, Linux, Active Directory, Microsoft 365, Azure, and AWS artifacts to reconstruct adversary activity, establish incident timelines, and determine root causes.
• Conduct forensic analysis of endpoint telemetry, SIEM alerts, EDR/XDR data, network packet captures, and system logs using Splunk, Microsoft Defender, Wireshark, and related security tools.
• Perform targeted threat hunting and IOC analysis using MITRE ATT&CK tactics, techniques, and procedures (TTPs) to identify previously undetected compromises.
• Support incident response teams with forensic evidence, attack-path reconstruction, compromise assessments, and technical recommendations for containment and remediation.
• Investigate suspected insider threats, unauthorized data access, account misuse, and potential data leakage while maintaining confidentiality and investigative integrity.
• Maintain forensic evidence integrity, chain-of-custody documentation, secure evidence storage, and repeatable forensic procedures in accordance with NIST SP 800-86 and applicable federal requirements.
• Develop and maintain forensic SOPs, investigation playbooks, evidence collection procedures, and analysis methodologies.
• Prepare detailed forensic examination reports documenting investigative methods, evidence, attack timelines, findings, potential impact, and recommended corrective actions.
• Coordinate with incident response, SOC, threat intelligence, legal, privacy, and Government stakeholders to support investigations, reporting, and post-incident reviews.

Required Qualifications

• Bachelor's degree in Cybersecurity, Digital Forensics, Computer Science, Information Technology, or a related field.
• 5+ years of hands-on digital forensics, incident investigation, or digital forensic incident response (DFIR) experience.
• Demonstrated experience with forensic imaging, memory analysis, malware investigation, evidence preservation, and chain-of-custody procedures.
• Proficiency investigating Windows, Linux, Microsoft 365, Azure, and AWS environments.
• Hands-on experience with forensic tools, SIEM platforms, EDR/XDR technologies, and network traffic analysis.
• Strong knowledge of MITRE ATT&CK, adversary TTPs, forensic artifacts, and investigative reporting.

Preferred Qualifications

• Experience supporting federal cybersecurity and digital forensic investigations in complex enterprise environments.
• Experience with malware reverse engineering, memory forensics, insider threat investigations, and cloud forensics.
• Familiarity with NIST SP 800-86, NIST SP 800-61, FISMA, and federal evidence handling requirements.
• Experience preparing forensic reports and presenting technical findings to Government leadership.
• GCFA, GCFE, GNFA, GREM, EnCE, or equivalent digital forensics certification.

Clearance Requirements

Must be a U.S. Citizen; Public Trust required. TS/SCI may be required for designated threat intelligence support activities.

Hybrid role based in Alexandria, VA. Initial 30 days onsite, followed by 2–3 days onsite per week.