Incident Response Senior Analyst (Tier 3)

Forensic Focus Limited; Virginia, Northern (IL, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Forensic Focus Limited is seeking a senior DFIR professional to manage government contract incidents from detection through resolution. You will perform memory and file system forensics, packet capture analysis, and log review in a highly secure environment.

The role requires DoD 8570 IAT II and CSSP Incident Responder certifications (or ability to obtain within 180 days), plus an active TS/SCI clearance; Secret clearance holders may start.

Qualifications

• Minimum 3 years of incident response experience.
• DoD 8570 IAT Level II certification is required.
• CSSP Incident Responder certification or ability to obtain within 180 days.

Responsibilities

• Lead end-to-end cyber incident management from detection to resolution.
• Perform forensic analysis of memory, file systems, and network captures; review logs and hosts.
• Contribute to training development and mentor junior analysts in a classified government environment.

Skills

Incident Response

Forensic Analysis

DFIR Tools

Network Analysis

Mentoring/Leadership

Education

DoD 8570 IAT Level II

CSSP Incident Responder

Active TS/SCI Clearance

Job description

The Role

This senior-level position supports a government CSSP contract, conducting end-to-end cyber incident management from initial detection through resolution. Day-to-day work includes forensic analysis of device memory, file systems and packet captures, log and host artifact review, detection use‑case development, and contributing to the delivery of an internal Incident Response training course.

Skills & Experience

Candidates must hold at least three years of incident response experience, a DoD 8570 IAT Level II certification, and a CSSP Incident Responder certification (or the ability to obtain within 180 days). An active TS/SCI clearance is required, though candidates with a fully adjudicated Secret clearance may start. Experience with pcap analysis, DFIR tooling, and enterprise network environments is expected.

Who It Suits

This role suits an experienced DFIR practitioner comfortable operating in a classified government environment who is ready to take ownership of complex investigations, guide junior analysts, and contribute to training development. Those with a DoD or law enforcement cyber background and existing clearances will be well positioned.