Digital Forensics & Incident Response (DFIR) Analyst (Forensics Specialist – Expert)

Forensic Focus; Herndon (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

VT Group (VTG) in Herndon, VA is seeking a Senior DFIR Analyst (Forensics Specialist – Expert) to respond to advanced cybersecurity incidents. The role involves live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud systems.

You will reconstruct attack timelines, identify IOCs, and guide remediation with detailed reports. The ideal candidate has extensive host and network forensics, incident response experience, and proficiency with Axiom, X-Ways, FTK,

Qualifications

• Extensive cybersecurity experience including host and network forensics.
• Experience in incident response and producing remediation guidance.
• Familiarity with digital forensics tools and artifact analysis.

Responsibilities

• Respond to complex cybersecurity incidents and coordinate containment.
• Perform live memory analysis, disk imaging, and forensic data acquisition.
• Reconstruct attack timelines and identify indicators of compromise.
• Conduct threat hunting and produce detailed forensic reports for stakeholders.

Skills

Incident response

Forensics analysis

Threat hunting

Communication with stakeholders

Education

Security+ / CISSP / GSEC certifications

Tools

Axiom

X-Ways

FTK

EnCase

Volatility

KAPE

Job description

# Digital Forensics & Incident Response (DFIR) Analyst (Forensics Specialist – Expert)*VT Group (VTG)***Herndon, VA**Onsite · Senior · Full-time### The RoleThis position involves responding to complex cybersecurity incidents, performing live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud systems. The analyst reconstructs attack timelines, identifies indicators of compromise, conducts threat hunting, and produces detailed forensic reports to guide remediation.### Skills & ExperienceRequires extensive cybersecurity experience including host and network forensics, incident response, and familiarity with tools such as Axiom, X-Ways, FTK, EnCase, Volatility, and KAPE. Knowledge of EDR/XDR platforms, artifact analysis (MFT, Registry, Event Logs), PCAP analysis, and relevant certifications like Security+, CISSP, or GSEC is expected.### Who It SuitsIdeal for experienced forensic and incident response professionals with a government or defense background, holding active security clearances, who enjoy deep technical investigation work and advising stakeholders on complex cyber threats.