Malware and Forensic Analyst (Senior)

cFocus Software Incorporated; Washington (District of Columbia); Remote; USD 80,000 - 120,000; Full time

Job summary

An innovative firm is seeking a Senior Malware and Forensic Analyst to support the US Courts in Washington, DC. This role offers remote capabilities and requires a seasoned professional with extensive experience in forensic analysis, particularly with operating systems like Windows, Linux, and macOS. The analyst will utilize advanced tools such as Magnet AXIOM and Encase to perform critical tasks including data carving, malware analysis, and incident response. This position promises a dynamic work environment where your expertise will directly contribute to enhancing cybersecurity measures within the judiciary sector. If you are passionate about digital forensics and eager to make a significant impact, this opportunity is for you.

Qualifications

• 5 years of experience in forensic analysis and malware analysis.
• Proficient with tools like Magnet AXIOM and Encase for digital forensics.

Responsibilities

• Provide digital forensics and incident response support to AOUSC.
• Analyze forensic artifacts and perform live forensic analysis.

Skills

Forensic Analysis

Malware Analysis

Data Carving Techniques

Incident Response

Operating Systems Analysis

Education

GIAC Certified Intrusion Analyst (GCIA)

GIAC Certified Incident Handler (GCIH)

EnCase Certified Examiner

Tools

Magnet AXIOM

SANS SIFT Workstation

Encase

Velociraptor

KAPE

Cellebrite

SIEM (Splunk)

Volatility

Job description

cFocus Software seeks a Malware and Forensic Analyst (Senior) to join our program supporting US Courts in Washington, DC. This position has remote capabilities.

Required Qualifications include:

1. 5 years of experience analyzing forensic artifacts, performing filesystem timeline analyses, and identifying intrusion root causes of operating systems (e.g., Windows, Linux, and macOS)
2. 5 years of experience utilizing the following forensics tools:
   1. Magnet AXIOM to acquire, analyze, and report on digital evidence;
   2. SANS SIFT Workstation for disk/memory analysis, network forensics, and malware analysis;
   3. Encase to collect, analyze, and report on digital evidence;
   4. Velociraptor to collect and analyze data from multiple endpoints;
   5. KAPE (Eric Zimmerman’s tools) to collect and process files;
   6. SUMURI TALINO Workstations/Laptops
   7. Cellebrite
   8. Bi-Weekly Threat Assessment Reports (BTARs)
3. Must have ability to perform required forensics/malware analyst duties, including:
   1. Create duplicates of evidence that ensure the original evidence is not unintentionally modified;
   2. Extracting deleted data using data carving techniques;
   3. Performing static and dynamic malware analysis to discover indicators of compromise (IOCs);
4. Must be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC

Desired Qualifications include:

1. One of the following certifications:
   1. GIAC Certified Intrusion Analyst (GCIA)
   2. GIAC Certified Incident Handler (GCIH)
   3. GIAC Continuous Monitoring (GMON)
   4. GIAC Defending Advanced Threats (GDAT)
   5. Splunk Core Power User
   6. EnCase Certified Examiner
   7. Sans GCFA
   8. Volatility Certified

Duties:

1. Provides digital forensics and incident response support to the AOUSC Security Operations Center (SOC). Collects, analyzes, and evaluates forensic artifacts associated with threat activity against Judiciary networks.
2. Accept and respond to government technical requests through the AOUSC ITSM ticket for advanced subject matter expert (SME) technical investigative support for real-time incident response (IR).
3. Create duplicates of evidence that ensure the original evidence is not unintentionally modified.
4. Analyze forensic artifacts of operating systems (e.g., Windows, Linux, and macOS) to discover elements of an intrusion and identify root cause.
5. Perform live forensic analysis based on SIEM data (e.g., Splunk).
6. Perform filesystem timeline analysis for inclusion in forensic report.
7. Extract deleted data using data carving techniques.
8. Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC.
9. Perform static and dynamic malware analysis to discover indicators of compromise (IOC).
10. Analyze memory images to identify malicious patterns using Judiciary tools (e.g., Volatility).

Deliverables:

1. Image Duplication: Duplication of evidence for processing by multiple analysts.
2. Deleted Files: Deleted files supplied to requestor.
3. Advanced SME IR Reports: Timely Advanced SME IR Support for Priority 1 Security Events.
4. Incident Reports: All forensic reports include a timeline.
5. Forensic Reports: Document the results of a forensic investigation.
6. Malware Analysis Reports: Document the results of analyzing a specific malware specimen.
7. Provide Weekly Reports to the AOUSC Program Manager that documents all activities, tasks, tickets and documents worked on.
8. Document repeatable Standard Operation Procedures (SOPs) and playbooks for security use cases.