Host Based Cyber Systems Analyst III

ARGO Cyber Systems; Arlington (VA); On-site; USD 120,000 - 140,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

401K

Job summary

ARGO Cyber Systems seeks an experienced Host Forensics Analyst to support a critical federal mission in Arlington, VA. You will perform host-based investigations, preserve and analyze digital evidence, and deliver detailed reports to leadership.

Requirements include active TS/SCI clearance, U.S. citizenship, and 8+ years in cyber forensics with strong writing and communication skills. Expect extensive travel to incident response sites nationwide.

Qualifications

• U.S. Citizenship is required.
• Active TS/SCI clearance required.
• DHS Suitability is required.
• Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, or related technical discipline, or equivalent experience.
• High School Diploma with 10+ years of host or digital forensics experience.
• Minimum 8 years of directly relevant cyber forensic investigations experience.

Responsibilities

• Lead onsite forensic teams, coordinate data collection and acquisition.
• Provide guidance on data collection methods and forensic procedures.
• Plan and direct examination of computers, hosts, and artifacts.
• Create forensic duplicates/images of systems.
• Mentor junior personnel on data collection, evidence analysis and reporting.
• Lead preliminary investigations and onsite incident response engagements.
• Analyze digital evidence to identify indicators of compromise and attack vectors.
• Evaluate and analyze suspected malicious code and artifacts.
• Characterize cyber attacks and stages of compromise.
• Ensure chain-of-custody and proper evidence handling.
• Write comprehensive technical reports and executive summaries.
• Conduct peer reviews of forensic reports and products.
• Act as a technical forensics liaison to customers and stakeholders.
• Track onsite activities and provide status updates to leadership.
• Conduct proactive system/network analysis and establish trust levels.

Skills

U.S. Citizenship

Active TS/SCI clearance

Cyber forensics

Host-based investigations

Digital forensics reporting

Data collection and preservation

Investigation methodologies

Technical writing

Travel willingness

Education

Bachelor's degree in Computer Science / Cybersecurity / related discipline

High School Diploma / GED with 10+ years of experience in host or digital forensics

Tools

EnCase

SIFT

X-Ways

Volatility

Wireshark

Sleuth Kit / Autopsy

Magnet AXIOM Cyber

Snort

Splunk

EDR platforms (CrowdStrike, MDE, Trellix)

Job description

Company: ARGO Cyber Systems (SDVOSB)

Location: Arlington, VA

Clearance: Active TS/SCI required

Employment Type: Full-Time

We are seeking experienced Host Forensics Analysts to support a critical federal customer mission. The ideal candidate will bring deep expertise in digital forensics, cyber incident response, host-based investigations, and forensic analysis, along with the ability to operate effectively in government environments.

The Host Forensics Analyst will support federal leads and forensic teams during onsite engagements, providing technical expertise throughout the collection, preservation, examination, analysis, and reporting of digital evidence. This position requires strong investigative judgement, attention to forensic integrity, excellent technical writing skills, and the ability to communicate complex findings to both technical and executive stakeholders.

Key Responsibilities

• Assist federal leads with overseeing and leading forensic teams during onsite engagements, including coordinating data collection and acquisition operations.
• Provide technical guidance on data collection methods, digital forensic procedures, and investigative techniques to appropriate personnel.
• Plan, coordinate, and direct the inventory, examination, and comprehensive technical analysis of computer systems, hosts, and digital artifacts.
• Create and maintain forensically sound duplicates and images of computer systems and digital evidence.
• Support forensic analysis and mentor junior personnel on data collection, evidence analysis, investigative methodologies, and technical reporting.
• Assist with leading and coordinating forensic teams during preliminary investigations and onsite incident response engagements.
• Conduct technical analysis of digital evidence to identify indicators of compromise, malicious activity, attack vectors, persistence mechanisms, and other artifacts associated with cyber incidents.
• Evaluate, extract, and analyze suspected malicious code and related artifacts.
• Analyze and characterize cyber attacks, including identifying attack classes, stages of compromise, tactics, techniques, and procedures.
• Ensure appropriate digital evidence collection, preservation, documentation, and chain-of-custody procedures are followed.
• Write comprehensive technical reports documenting forensic findings, investigative methodologies, analysis, and conclusions.
• Distill complex analytic findings into clear executive summaries and detailed technical reports for leadership and stakeholders.
• Conduct peer reviews and quality assurance reviews of forensic products and reports, particularly those prepared by junior personnel.
• Serve as a technical forensics liaison to customers and stakeholders, explaining investigative findings, forensic methodologies, protocols, and supporting evidence.
• Track and document onsite incident response activities and provide regular status updates to federal leadership throughout an engagement.
• Conduct proactive analysis of systems and networks, including evaluating and establishing trust levels for critical resources.
• Collaborate effectively with forensic, cybersecurity, incident response, and customer teams operating across multiple physical locations.
• Travel to incident response locations throughout the United States, U.S. Territories, and Possessions as required

Required Qualifications

• U.S. Citizenship required.
• Active TS/SCI security clearance required.
• Ability to obtain DHS Suitability.
• Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline; or
• High School Diploma/GED with 10+ years of host or digital forensics experience.
• Minimum 8 years of directly relevant experience conducting cyber forensic investigations using industry-standard forensic tools and leading-edge technologies.
• Demonstrated experience conducting host-based and/or digital forensic investigations.
• Experience creating forensically sound duplicates and forensic images of computer systems.
• Demonstrated ability to produce comprehensive cyber investigative reports documenting digital forensic findings.
• Experience analyzing and characterizing cyber attacks and related digital evidence.
• Knowledge of proper digital asset collection, preservation, handling, and chain-of-custody procedures.
• Demonstrated ability to identify different classes of cyber attacks and stages of compromise.
• Knowledge of system and application security threats, vulnerabilities, and attack methodologies.
• Knowledge and experience conducting proactive analysis of systems and networks, including establishing trust levels for critical resources.
• Strong technical writing, analytical, communication, and presentation skills.
• Ability to work collaboratively with geographically dispersed teams and stakeholders.
• Ability and willingness to travel extensively to support onsite incident response engagements.

Desired Skills

• EnCase
• SIFT
• X-Ways
• Volatility
• Wireshark
• Sleuth Kit / Autopsy
• Magnet AXIOM Cyber
• Snort
• Splunk or other SIEM platforms, including ArcSight, LogRhythm, Elastic, or similar
• EDR platforms, including CrowdStrike, Microsoft Defender for Endpoint (MDE), Trellix, or similar technologies
• Other industry-standard digital forensics, incident response, SIEM, EDR, or security analysis tools

Desired Certifications

• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Forensic Examiner (GCFE)
• EnCase Certified Examiner (EnCE)
• Certified Computer Examiner (CCE)
• Certified Forensic Computer Examiner (CFCE)
• Certified Information Systems Security Professional (CISSP)

Company Benefits

ARGO Cyber Systems provides industry competitive employee benefits to include medical, dental, vision, life insurance, and 401K.

Argo Cyber Systems is a Federal Contractor and an Equal Opportunity Employer.

Salary: $120000 - $140000 per year