Digital Forensics & Incident Response (DFIR) Analyst (Forensics Specialist - Expert)

Vtgdefense; Herndon (VA); On-site; USD 130,000 - 240,000; Full time

Job summary

VTG Defense in Herndon, VA seeks a DFIR Analyst to lead live memory analysis, disk imaging, and forensic data acquisition while enforcing strict chain-of-custody. You will map threat actor movement across endpoints and cloud, building comprehensive incident timelines and IOCs for rapid containment.

The role requires 11+ years in cybersecurity, DoD 8570 IAT Level II compliance, and hands-on experience with major forensic suites and EDR/XDR platforms.

Qualifications

• Top Secret/SCI with Polygraph clearance.
• 11+ years of Cyber Security experience with Government programs.
• 2+ years in host/network forensics, threat hunting, or Tier 3 incident response.
• Experience with EDR/XDR platforms.
• Experience analyzing host artifacts and PCAPs.

Responsibilities

• Performs live memory analysis, disk imaging, and forensic data acquisition with strict chain-of-custody protocols.
• Analyzes endpoint, cloud, and system log data to map threat actor movement and build incident timelines.
• Communicates with customer to coordinate threat containment and eradication strategies.
• Conducts threat hunting to uncover APTs and persistence mechanisms.
• Prepares detailed forensic reports and root-cause analyses to justify remediation and changes.
• Advises customer on impacts, zero-day vulnerabilities, and threat trends.
• Collaborates with cyber defense teams to deploy updates and countermeasures.
• Identifies gaps in logging architectures and provides engineering recommendations.

Skills

Threat hunting

Incident response

Communication

Forensic analysis

DoD 8570 IAT Level II

Education

BS in digital forensics / cybersecurity

BS in computer science or related IT discipline

Tools

Axiom

X-Ways

FTK

EnCase

Volatility

KAPE

Job description

Overview

The Digital Forensics & Incident Response (DFIR) Analyst leads the detection, containment, and forensic investigation of complex cybersecurity incidents within the organization. This professional acts as a core responder to active threats, securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes. The DFIR Analyst bridges technical forensics with risk mitigation, translating complex indicators of compromise into tactical response actions and enterprise countermeasures. At ManTech, you will help protect our national security while working on innovative projects that offer opportunities for advancement. Your role will be Monday - Friday with Core hours based in Herndon, VA.

What will you do?

• Performs live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints while maintaining strict chain-of-custody protocols
• Analyzes endpoint, cloud, and system log data to map threat actor movement, build comprehensive incident timelines, and isolate indicators of compromise (IOCs)
• Communicates with the customer and affected end users to coordinate immediate threat containment and eradication strategies
• Conducts proactive and reactive threat hunting across the network to uncover advanced persistent threats (APTs) and hidden persistence mechanisms
• Prepares detailed technical forensic reports and root-cause analyses to justify Incident Response remediation, recovery plans, and network modifications
• Advises the customer on technical impacts, zero-day vulnerabilities, and threat trends affecting organizational equities
• Collaborates with cyber defense teams to deploy tactical signature updates, endpoint rules, and enterprise-wide countermeasures post-incident
• Identifies gaps in current logging, visibility, and logging architectures, providing actionable engineering recommendations to mature continuous monitoring capabilities

Do you have what it takes?

Basic Qualifications:

• Must have a Top Secret/SCI with Polygraph.
• 11 years of experience in Cyber Security with Government programs, with 2+ years of dedicated experience in host/network forensics, threat hunting, or Tier 3 incident response.
• 2+ Hands-on proficiency with commercial and open-source forensic suites (e.g., Axiom, X-Ways, FTK, EnCase, Volatility, or KAPE) and Enterprise Detection & Response (EDR/XDR) platforms.
• 2+ Direct experience analyzing host artifacts (MFT, Registry, Event Logs), volatile memory, and network packet captures (PCAP) to reconstruct cyber attacks.
• Strong written and verbal communications skills to effectively translate deep technical analysis into brief summaries for non-technical stakeholders.
• DoD 8570 IAT Level II Compliant (such as Sec+, CISSP, CySA, CCNA, GSEC, SSCP).

Preferred:

• BS (bachelor's degree in digital forensics, cybersecurity, computer engineering, computer science, or other closely related IT discipline)
• SANS or CYSA certifications

PayRange: VTG's estimated starting pay range is $130,000-$240,000 annually, which is a general guideline for the geographic location. When extending an offer, VTG also considers work experience, education, skill level, market considerations and may possibly include contractual requirements which may cause an offer to fall outside of this range.