Onsite Cyber Forensic Analyst - Incident Response

Nightwing Intelligence Solutions, LLC; Sterling (VA); On-site; USD 77,000 - 163,000; Full time

Benefits offered by this job

Medical, Vision & Dental Insurance

401(k)

PTO & Holidays

Job summary

Nightwing seeks a Cyber Host Forensic Analyst to support a U.S. Government customer with onsite incident response for civilian agencies and critical assets. You will collect artifacts, triage devices, and correlate findings with network events to build intrusion narratives.

Required are U.S. citizenship, a TS/SCI clearance, DHS suitability, and 2+ years of cyber forensic experience. Candidates must document evidence, write reports, and collaborate across locations.

Qualifications

• U.S. Citizenship required; active TS/SCI clearance or ability to obtain
• Must be able to obtain DHS Suitability
• 2+ years of directly relevant cyber forensic investigations experience
• Ability to create forensically sound duplicates of evidence (forensic images)
• Able to write cyber investigative reports documenting digital forensics findings
• Experience with analysis and characterization of cyber attacks
• Experience with proper evidence handling procedures and chain of custody
• Skilled in identifying different classes of attacks and attack stages
• Knowledge of system and application security threats and vulnerabilities
• Must work collaboratively across physical locations

Responsibilities

• Acquire/collect computer artifacts from systems during onsite engagements
• Assess evidentiary value by triaging devices
• Correlate forensic findings with network events to develop intrusion narrative
• Document system state information prior to imaging when available
• Perform incident triage from a forensic perspective (scope, urgency, impact)
• Track and document forensic analysis from involvement to resolution
• Process, preserve, analyze and present computer-related evidence
• Coordinate with Government and customer personnel to validate alerts
• Draft forensic write-ups for inclusion in reports
• Publish Computer Network Defense guidance and incident findings
• Trace activity to its source and document findings for reports
• Document original condition of evidence (photos, hash data)
• Assist imaging of digital media
• Gather/access/evaluate evidence from electronic devices using forensic tools
• Use hashing to validate images
• Identify adversary TTPs with mentor
• Analyze behaviors of malicious software
• Locate critical items across file systems to aid senior personnel
• Analyze log files to identify threats to computer security
• Use forensic tools and procedures to provide insights into intrusions
• Follow evidence handling and chain-of-custody procedures
• Produce written reports documenting digital forensic findings
• Determine programs executed and files changed on disk/memory
• Develop authoritative timelines using host/network timestamps/logs
• Find deleted files and hidden data
• Document case-relevant file-system artifacts
• Create forensically sound duplicates for data recovery and analysis
• Perform all-source research for related events

Skills

U.S. Citizenship

Active TS/SCI clearance

DHS Suitability

Cyber forensic investigations

Forensic reports

Cyber attack analysis

Evidence handling

Incident response

Team collaboration

Education

BS Computer Science / Computer Engineering / CIS / related

Tools

EnCase

FTK

SIFT

X-Ways

Volatility

Wireshark

Sleuth Kit/Autopsy

Splunk

EDR tools

Job description

Nightwing seeks a Cyber Host Forensic Analyst to support a U.S. Government customer with onsite incident response for civilian agencies and critical assets. You will collect artifacts, triage devices, and correlate findings with network events to build intrusion narratives.

Required are U.S. citizenship, a TS/SCI clearance, DHS suitability, and 2+ years of cyber forensic experience. Candidates must document evidence, write reports, and collaborate across locations.