Senior Cloud Forensics Analyst

Nightwing Group

Arlington, Northern (VA, KY)

Hybrid

USD 140,000 - 190,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

Nightwing seeks a Cloud Forensic Analyst IV to support onsite incident response for a U.S. Government customer in Arlington, VA. The role focuses on collecting artifacts, triaging devices, and correlating forensic findings to network events to craft intrusion narratives.

The candidate will document system state, perform forensic triage, and produce reports with evidence handling and chain-of-custody compliance. A TS/SCI clearance and cloud forensics expertise are required.

Qualifications

U.S. Citizenship is required.
Active TS/SCI clearance is required.
Ability to obtain DHS Entry on Duty suitability.
10 years of direct relevant experience in cyber forensic investigations using leading edge technologies and industry standard forensic tools.
In-depth understanding of SaaS, PaaS and IaaS in the Cloud Environment.
Ability to create forensically sound duplicates of evidence.
Ability to author cyber investigative reports documenting digital forensics findings.
Proficiency with analysis and characterization of cyber attacks.
Proficiency with proper evidence handing procedures and chain of custody protocols.
Skilled in identifying different classes of attacks and attack stages.
Understanding of system and application security threats and vulnerabilities.
Understanding of proactive analysis of systems and networks, to include creating trust levels of critical resources.
Able to work collaboratively across physical locations.
Action-oriented and have a proactive approach to problem solving.
Proficiency with common operating systems (Linux/Unix, Windows)

Responsibilities

Acquire/collect computer artifacts (e.g., malware, user activity, link files) in support of onsite engagements.
Triage electronic devices and assess evidentiary value.
Correlate forensic findings to network events in support of developing an intrusion narrative.
Collect and document system state information prior to imaging, as required.
Perform forensic triage of an incident to include determining scope, urgency and potential impact.
Track and document forensic analysis from initial participation through resolution.
Collect, process, preserve, analyze and present computer related evidence.
Coordinate with Government staff and customer personnel to validate/investigate alerts or additional preliminary findings.
Conduct analysis of forensic images, and available evidence in support of forensic write-ups for inclusion in reports and written products.
Assist with documenting and publishing Computer Network Defense (CND) guidance and reports pertaining to incident findings.