Digital Forensics & Incident Response (DFIR) Analyst (Forensics Specialist - Expert)

VTG Defense; Herndon (VA); On-site; USD 130,000 - 240,000; Full time

Job summary

VTG Defense in Herndon, VA is seeking a DFIR Analyst to lead detection, containment, and forensic investigation of complex cybersecurity incidents. This role focuses on securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes.

The DFIR Analyst acts as a core responder to active threats, translating indicators of compromise into tactical actions and enterprise countermeasures, with DoD 8570 IAT II compliance and TS/SCI with

Qualifications

• 11+ years in cyber security with government programs.
• 2+ years in host/network forensics, threat hunting, or Tier 3 incident response.
• Proficient with forensic suites and EDR/XDR platforms.

Responsibilities

• Perform live memory analysis and disk imaging with strict chain-of-custody.
• Analyze logs to map attacker movement and build incident timelines.
• Coordinate threat containment and remediation with customers.
• Develop detailed forensic reports and root-cause analyses.
• Advise customers on vulnerabilities and threat trends.

Skills

Cyber Security

Host Forensics

Threat Hunting

Incident Response

Communications

DoD 8570 IAT II

Education

Bachelor’s degree in digital forensics or cybersecurity

Tools

Axiom

X-Ways

FTK

EnCase

Volatility

KAPE

EDR/XDR platforms

Job description

Overview

The Digital Forensics & Incident Response (DFIR) Analyst leads the detection, containment, and forensic investigation of complex cybersecurity incidents within the organization. This professional acts as a core responder to active threats, securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes. The DFIR Analyst bridges technical forensics with risk mitigation, translating complex indicators of compromise into tactical response actions and enterprise countermeasures. At ManTech, you will help protect our national security while working on innovative projects that offer opportunities for advancement. Your role will be Monday - Friday with Core hours based in Herndon, VA.

What will you do?

• Performs live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints while maintaining strict chain-of-custody protocols
• Analyzes endpoint, cloud, and system log data to map threat actor movement, build comprehensive incident timelines, and isolate indicators of compromise (IOCs)
• Communicates with the customer and affected end users to coordinate immediate threat containment and eradication strategies
• Conducts proactive and reactive threat hunting across the network to uncover advanced persistent threats (APTs) and hidden persistence mechanisms
• Prepares detailed technical forensic reports and root-cause analyses to justify Incident Response remediation, recovery plans, and network modifications
• Advises the customer on technical impacts, zero-day vulnerabilities, and threat trends affecting organizational equities
• Collaborates with cyber defense teams to deploy tactical signature updates, endpoint rules, and enterprise-wide countermeasures post-incident
• Identifies gaps in current logging, visibility, and logging architectures, providing actionable engineering recommendations to mature continuous monitoring capabilities

Do you have what it takes?

Basic Qualifications:

• Must have a Top Secret/SCI with Polygraph.
• 11 years of experience in Cyber Security with Government programs, with 2+ years of dedicated experience in host/network forensics, threat hunting, or Tier 3 incident response
• 2+ Hands-on proficiency with commercial and open-source forensic suites (e.g., Axiom, X-Ways, FTK, EnCase, Volatility, or KAPE) and Enterprise Detection & Response (EDR/XDR) platforms
• 2+ Direct experience analyzing host artifacts (MFT, Registry, Event Logs), volatile memory, and network packet captures (PCAP) to reconstruct cyber attacks
• Strong written and verbal communications skills to effectively translate deep technical analysis into brief summaries for non-technical stakeholders
• DoD 8570 IAT Level II Compliant (such as Sec+, CISSP, CySA, CCNA, GSEC, SSCP)

Preferred:

• BS (bachelor's degree in digital forensics, cybersecurity, computer engineering, computer science, or other closely related IT discipline)
• SANS or CYSA certifications

PayRange: VTG's estimated starting pay range is $130,000-$240,000 annually, which is a general guideline for the geographic location. When extending an offer, VTG also considers work experience, education, skill level, market considerations and may possibly include contractual requirements which may cause an offer to fall outside of this range.