Network Forensics Analyst

Forensic Focus; Arlington (VA); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Forensic Focus is seeking an experienced network forensics/incident response expert to support a federal hunt and incident response team. You will analyze network traffic, logs and device configurations to detect anomalies and reconstruct attacker activity during on-site and remote engagements.

The role requires deep knowledge of Cisco, Ivanti, Palo Alto, Ciena and Juniper, plus PCAP, flow data, DNS and proxy log analysis, network topology assessment and threat actor TTPs.

Qualifications

• Deep expertise in edge-device technologies from leading vendors.
• Strong capabilities in network traffic and log analysis for incident response.
• Experience interfacing with government clients on high-pressure investigations.

Responsibilities

• Investigate cyber intrusions affecting critical infrastructure.
• Analyze network traffic, logs and device configurations to detect anomalies.
• Reconstruct attacker activity and advise on containment and eradication.
• Lead technical analysis during on-site and remote engagements.

Skills

PCAP analysis

Flow data analysis

DNS analysis

Proxy log analysis

Network topology assessment

Threat actor TTPs

Device integrity validation

Tools

Cisco

Ivanti

Palo Alto

Ciena

Juniper

Job description

The Role

This position supports a federal hunt and incident response team, investigating cyber intrusions affecting critical infrastructure. Work includes analyzing network traffic, logs and device configurations to detect anomalies, reconstruct attacker activity, and advise on containment, eradication and hardening measures during on-site and remote engagements.

Skills & Experience

Requires deep expertise in edge-device technologies such as Cisco, Ivanti, Palo Alto, Ciena and Juniper, plus strong knowledge of PCAP, flow data, DNS and proxy log analysis, network topology assessment, threat actor TTPs, and device integrity validation methodologies.

Who It Suits

Ideal for experienced network forensics or incident response specialists comfortable acting as a subject matter expert on high-pressure investigations, interfacing directly with government clients and leading technical analysis of complex network-centric compromises.