Network Forensics Analyst (IV) Information Technology Arlington, VA

NewGen Technologies, Inc.; Arlington (VA); Hybrid; USD 120,000 - 170,000; Full time

Job summary

NewGen Technologies is seeking a Network Forensics Analyst with deep expertise in edge device technologies to support government missions. You will lead hunt and incident response efforts, analyzing network traffic, PCAPs, and device logs across Cisco, Ivanti, Palo Alto, Ciena, and Juniper.

The role requires extensive experience in incident response and network forensics, with the ability to communicate findings to both technical and non-technical stakeholders and collaborate across distributed

Qualifications

• Bachelor's degree in Computer Science, Cyber Security, Computer Engineering, or related field; OR HS Diploma and 10+ years of technical experience.
• 8+ years of directly relevant experience in network forensics and incident response.
• 3+ years evaluating and implementing new cyber response or network forensic capabilities.
• Hands-on experience with incident response or network operations involving edge devices from at least two listed vendors.
• Strong understanding of network architecture and security (routing, switching, VPNs, firewalls, segmentation).
• Knowledge of CND policies and U.S. government environment requirements.

Responsibilities

• Serve as hunt and incident response SME focusing on network-centric edge device compromises
• Evaluate and integrate new network forensic and monitoring capabilities
• Coordinate with government leads during onsite and remote investigations
• Characterize and analyze network traffic using PCAP, flow, and device logs
• Reconstruct malicious activity and map attacker paths across the network
• Assess topology, configurations, and defenses for Cisco, Ivanti, Palo Alto, Ciena, Juniper platforms

Skills

Threat hunting

Incident response

Network forensics

Edge devices

Network architectures

Education

Bachelor's degree in CS/Cybersecurity/Engineering

HS Diploma with 10+ years experience

Tools

Cisco

Ivanti

Palo Alto

Ciena

Juniper

Job description

Our Partner provides support for on-and-off-siteincident response to government agencies and critical infrastructure owners who experience cyber-attacks. They deliver advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans. They are seeking a Network Forensics Analyst with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.

Responsibilities

• Serveas a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises
• Serveas an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities
• Assist the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements
• Assistthe Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations
• Characterizeand analyze network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources
• Identifyand analyzeanomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity
• Reconstructmalicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns
• Examinenetwork topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities
• Assessnetwork topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms
• Determineappropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions
• Apply knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations
• Applyknowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation
• Leadanalysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions
• Provideexpert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities
• Serveas a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents
• Exerciseconsiderable latitude in determining technical objectives and independently developtechnical solutions to complex problems requiring ingenuity and creativity
• Analyzeincident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening
• Advise technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists)
• Support internal stakeholders on containment and eradication missions, on-site and remotely
• Ensureevidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs
• Assistwith the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies
• Distillanalytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences
• Documentanalysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication
• Assistin maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities

Requirements

• US Citizenship
• TS/SCI Clearance
• Ability to obtain DHS Suitability
• BS in Computer Science, Cyber Security, Computer Engineering, or related degree; OR HS Diploma and 10+ years of technical experience in the area of expertise
• 8+ years of directly relevant experience
• 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities
• Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments
• Ability to:
  • Characterize and analyze network traffic to identify anomalous activity and potential threats
  • Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.)
  • Reconstruct malicious activity based on network traffic and device logs
• Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network
• Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic
• Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior
• Proficiency with common operating systems (e.g., Linux/Unix, Windows)
• Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments
• Ability to think independently, make sound decisions under pressure, and work with limited guidance
• Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders
• Ability to work collaboratively across physical locations and within distributed teams
• Skilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations
• Rapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air-gapped traffic

Desired Skills

• Experience leading and mentoring technical teams in incident response, network operations, or security engineering
• Network and system administration experience in large or complex enterprise or service-provider environments
• Strong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non nation state adversaries, nation state actors)
• Knowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, malicious code)
• Knowledge of network device integrity verification and monitoring approaches
• Hands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM)
• Experience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection
• Experience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures
• Ability to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture-level improvements
• Ability to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership)
• Field Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate
• Compact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry-on/air-transport limits

Desired Certifications (one or more)

• IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH
• SANS GIAC GCIA or GNFA (preferred for network forensics)
• SANS GRID, GICSP, or GCIP (plus)
• Vendor / network certifications (highly desired):
  • Cisco CCNA (or higher: CCNP Security, CCNP Enterprise)
  • Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.)

About Us

For more than 20 years, NewGen Technologies has solved our clients' toughest IT challenges with integrity, security, and outstanding service by delivering both technology and talent. We have helped secure borders, have used artificial intelligence (AI) to fight terror, aided the identification of criminals, and have helped to prevent crime through the introduction of biometrics.Our team of Highly Cleared Specialists have hard-to-find skills and expertise in a wide spectrum of technologies to provide solutions that transform business processes and solve problems of national significance.