Remote Edge Network Forensics Analyst (TS/SCI)

ARGO Cyber Systems, LLC; Arlington (VA); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Argo Cyber Systems seeks a Network Forensics Defense Analyst to support DHS HIRT operations, focusing on network-centric incidents and edge-device compromises across Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms. The role requires active TS/SCI clearance and U.S.

citizenship to coordinate investigations both on-site and remotely. The analyst will analyze traffic, reconstruct attack timelines, and provide remediation guidance while collaborating with government teams and senior

Qualifications

• U.S. Citizenship required.
• Active TS/SCI clearance.
• 8+ years of directly relevant experience.
• Experience with enterprise edge devices from at least two vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and defense in depth.

Responsibilities

• Serves as a hunt and incident response SME focusing on network-centric edge device compromises.
• Evaluates and integrates new network forensic and monitoring capabilities.
• Coordinates on-site and remote investigations with Government teams.
• Interprets and communicates findings to leadership and technicians.
• Analyzes network traffic (PCAP, flow, device logs) to identify threats.
• Reconstructs attacker timelines and data exfiltration patterns.

Skills

Edge device expertise

TS/SCI clearance

U.S. Citizenship

Incident response

Network forensics

Clear communication

Education

BS in Computer Science, Cyber Security, or related

HS Diploma + 10+ years experience

Tools

Cisco IOS

Ivanti

Palo Alto Networks

Ciena

Juniper Networks

Job description

Argo Cyber Systems seeks a Network Forensics Defense Analyst to support DHS HIRT operations, focusing on network-centric incidents and edge-device compromises across Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms. The role requires active TS/SCI clearance and U.S.

citizenship to coordinate investigations both on-site and remotely. The analyst will analyze traffic, reconstruct attack timelines, and provide remediation guidance while collaborating with government teams and senior