Incident Response and Forensic Analyst

The Aerospace Corporation; Colorado Springs (CO); Vor Ort; USD 135.000 - 203.000; Vollzeit

Benefits dieser Stelle

Health care

Paid holidays and vacation

Relocation assistance

Education assistance

Flexible work schedules

Zusammenfassung

The Aerospace Corporation is seeking an experienced Incident Response and Forensic Analyst to lead investigations and drive containment, eradication, and recovery efforts for security incidents. You’ll conduct in-depth forensics, preserve evidence, and develop robust response playbooks within a team of cybersecurity professionals protecting classified and unclassified environments.

The role requires 5–7 years in incident response or digital forensics, strong tool proficiency (EnCase, FTK,

Qualifikationen

• Bachelor's degree or equivalent in cybersecurity, computer science, digital forensics, information systems or related field.
• 5–7 years of incident response or digital forensics experience.
• Hands-on forensics on Windows, Linux and/or macOS.
• Proficiency with leading forensic tools (EnCase, FTK, X-Ways, Autopsy).
• Strong evidence handling, chain of custody, and reporting skills.

Aufgaben

• Lead incident response activities from detection through containment, eradication, recovery and post-incident analysis.
• Conduct digital forensic investigations on compromised systems, networks and endpoints to determine root cause and scope.
• Perform forensic analysis of disk images, memory dumps, network traffic and log data using industry-standard tools.
• Preserve digital evidence following chain-of-custody procedures for potential legal proceedings.
• Develop and maintain incident response playbooks, procedures and forensic workflows.
• Coordinate with SOC, IT operations, legal, and business stakeholders during active incidents.
• Document timelines, findings and remediation in detailed technical reports.
• Provide expert testimony and briefings to technical teams and management.
• Mentor junior analysts and share expertise across the team.

Kenntnisse

Incident response

Digital forensics

Windows

Linux

macOS

EnCase

FTK

X-Ways

Memory forensics

Network forensics

Python scripting

Ausbildung

Bachelor's degree in Cybersecurity/CS/Forensics

Tools

EnCase

FTK

X-Ways

Autopsy

Wireshark

tcpdump

NetworkMiner

Jobbeschreibung

The Aerospace Corporation is the trusted partner to the nation’s space programs, solving the hardest problems and providing unmatched technical expertise. As the operator of a federally funded research and development center (FFRDC), we are broadly engaged across all aspects of space— delivering innovative solutions that span satellite, launch, ground, and cyber systems for defense, civil and commercial customers. When you join our team, you’ll be part of a special collection of problem solvers, thought leaders, and innovators. Join us and take your place in space.The Aerospace Corporation is seeking an experienced cybersecurity professional to serve as an Incident Response and Forensic Analyst ( Information Security Staff IV) . In this critical role, you will be responsible for investigating security incidents, conducting digital forensic examinations, and leading response efforts to protect our organization's critical assets. You will analyze complex security events, preserve and examine digital evidence, develop incident response procedures, and provide expert recommendations to contain and remediate cyber threats. You will join a team of dedicated cybersecurity professionals who are chartered with securing Aerospace's classified and unclassified enterprise IT environments and viewed as leaders within the aerospace community.The selected candidate will be required to work full-time on-site at our facility in Colorado Springs, CO.What You'll Be DoingLeading incident response activities from initial detection through containment, eradication, recovery, and post-incident analysisConducting digital forensic investigations on compromised systems, networks, and endpoints to determine root cause, scope, and impact of security incidentsPerforming forensic analysis of disk images, memory dumps, network traffic, and log data using industry-standard tools and methodologiesPreserving digital evidence following proper chain of custody procedures to ensure forensic integrity and support potential legal proceedingsAnalyzing malware samples and attacker techniques to understand threat actor behavior and develop defensive countermeasuresDeveloping and maintaining incident response playbooks, procedures, and forensic investigation workflowsCoordinating with SOC, IT operations, legal, and business stakeholders during active incident response operationsDocumenting incident timelines, findings, and remediation activities in comprehensive technical reportsProviding expert testimony and briefings on forensic findings to technical teams, management, and potentially legal counselContributing to threat intelligence by identifying indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs) from investigationsConducting post-incident reviews and lessons learned sessions to drive continuous improvementRemaining informed on the latest incident response methodologies, forensic techniques, threat actor trends, and emerging attack vectorsMentoring junior analysts and sharing forensic expertise across the cybersecurity teamWhere necessary, providing after-hours support during critical security incidents requiring immediate investigationWhat You Need to be Successful- Information Security Staff IVMinimum Requirements:Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Systems or equivalent field of study, or equivalent experience5-7 years of relevant experience in incident response, digital forensics, or cybersecurity investigationsHands-on experience conducting forensic investigations on Windows, Linux, and/or macOS systemsProficiency with forensic tools such as EnCase, FTK, X-Ways, Autopsy, or similar platformsStrong understanding of file systems, operating system artifacts, and forensic analysis techniquesExperience with memory forensics and volatile data analysisKnowledge of network forensics and packet analysis using tools like Wireshark, tcpdump, or NetworkMinerUnderstanding of malware analysis fundamentals and attacker methodologiesExperience with incident response frameworks (NIST SP 800-61, SANS Incident Response, etc.)Ability to work under pressure during active security incidents and manage multiple concurrent investigationsExcellent analytical and critical thinking skills with strong attention to detailStrong written and verbal communication skills, including the ability to document technical findings clearlyExperience with evidence collection, preservation, and chain of custody proceduresUnderstanding of legal and regulatory requirements related to digital evidence and incident reportingThis position requires the ability to obtain and maintain a US Secret security clearance, which is issued by the US government. U.S citizenship is required to obtain a security clearance.How You Can Stand OutIt would be impressive if you have one or more of these:Relevant certifications such as GCFA, GCFE, GREM, GNFA, CISSP, or equivalentExperience with cloud forensics (AWS, Azure, GCP) and cloud-native incident responseHands-on malware analysis and reverse engineering experienceExperience investigating advanced persistent threats (APTs) or nation-state actorsProficiency with scripting languages (Python, PowerShell, Bash) for forensic automationExperience with SIEM platforms and log analysis for incident investigationKnowledge of threat intelligence platforms and integration of IOCs into defensive operationsExperience conducting forensic investigations in classified environmentsBackground with endpoint detection and response (EDR) tools such as CrowdStrike, Carbon Black, or SentinelOneExperience developing custom forensic tools or automation scriptsTrack record of presenting forensic findings to executive leadership or in legal proceedingsExperience with mobile device forensics (iOS, Android)Familiarity with the MITRE ATT&CK framework and mapping incident findings to adversary techniquesCurrent and active Secret clearanceWe offer a competitive compensation package where you’ll be rewarded based on your performance and recognized for the value you bring to our business. The grade-based pay range for this job is listed below. Individual salaries within that range are determined through a wide variety of factors including but not limited to education, experience, knowledge and skills.(Min - Max)$135,200.00 - $202,800.00Pay Basis: AnnualLeadership CompetenciesOur leadership philosophy is simple: every employee, regardless of level and role, can demonstrate leadership. At Aerospace, our commitment is our people. To cultivate our talent and ensure that we have a strong pipeline of future leaders, we want individuals who:Operate StrategicallyLead ChangeEngage with ImpactFoster InnovationDeliver ResultsWays We Reward Our EmployeesDuring your interview process, our team will provide details of our industry-leading benefits.Benefits vary and are applicable based on Job Type. A few highlights include:Comprehensive health care and wellness plansPaid holidays, sick time, and vacationStandard and alternate work schedules, including telework options401(k) Plan — Employees receive a total company-paid benefit of 8%, 10%, or 12% of eligible compensation based on years of service and matching contributions; employees are immediately eligible and vested in the plan upon hireFlexible spending accountsVariable pay program for exceptional contributionsRelocation assistanceProfessional growth and development programs to help advance your careerEducation assistance programsAn inclusive work environment built on teamwork, flexibility, and respectWe are all unique, from various backgrounds and all walks of life, yet one thing bonds all of us to each other—the belief that we can make a difference. This core belief empowers us to do our best work at The Aerospace Corporation.Equal Opportunity CommitmentThe Aerospace Corporation is an equal opportunity employer. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, age, sex (including pregnancy, childbirth, and related medical conditions), sexual orientation, gender, gender identity or expression, color, religion, genetic information, marital status, ancestry, national origin, protected veteran status, physical disability, medical condition, mental disability, or disability status and any other characteristic protected by state or federal law. If you’re an individual with a disability or a disabled veteran who needs assistance using our online job search and application tools or need reasonable accommodation to complete the job application process, please contact us by phone at 310.336.5432 or by email at [e-mail] . You can also review Know Your Rights: Workplace Discrimination is Illegal .