Lead DFIR Incident Response & Forensics

Booz Allen; McLean (VA); Sur place; USD 113 000 - 257 000; Plein temps

Résumé du poste

Booz Allen Hamilton in McLean, VA is seeking a DFIR Team Lead to guide a skilled incident-response group, drive timely containment of major incidents, and communicate findings to senior leaders. You will mentor junior analysts, develop incident documentation, and help advance program improvements within the Digital Forensics and Incident Response domain.

Required: 3+ years in DFIR, experience with Windows/macOS/Linux, FTK/EnCase/XWF/Axiom, Python or PowerShell; ability to work after hours and

Qualifications

• 3+ years of experience with digital forensics or incident response.
• Experience analyzing Windows/macOS/Linux systems, and using DFIR toolsets.
• Experience with scripted DFIR toolsets written in Python or PowerShell.
• Experience analyzing logs (firewall, network traffic, IIS, Antivirus, DNS).
• Knowledge of common forensic artifacts analyzed during incidents to determine attack, vector, lateral movement, and data exfiltration.
• Ability to correlate events from multiple sources to create a timeline analysis.
• Ability to organize case notes and communicate verbally and in writing to clients.
• Ability to prepare detailed technical reports and work after hours including on-call rotations.

Responsabilités

• Lead incident response for major incidents and coordinate containment.
• Develop, maintain, and review incident documentation and reports.
• Guide junior analysts and foster learning in the DFIR domain.
• Provide status updates to Cybersecurity and Operations leaders, legal, and clients.

Connaissances

IR experience

Digital forensics

Windows/macOS/Linux

Scripting Python/PowerShell

Log analysis

Forensic artifacts

Timeline analysis

Client communication

On-call readiness

Formation

HS diploma or GED

Bachelor's degree preferred

Outils

FTK

EnCase

XWF

Axiom

Description du poste

Booz Allen Hamilton in McLean, VA is seeking a DFIR Team Lead to guide a skilled incident-response group, drive timely containment of major incidents, and communicate findings to senior leaders. You will mentor junior analysts, develop incident documentation, and help advance program improvements within the Digital Forensics and Incident Response domain.

Required: 3+ years in DFIR, experience with Windows/macOS/Linux, FTK/EnCase/XWF/Axiom, Python or PowerShell; ability to work after hours and