Senior Cloud Forensics Analyst - CNDA (Remote)

ARGO Cyber Systems; Arlington (VA); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Argo Cyber Systems is seeking Cyber Network Defense Analysts with deep Cloud Forensics expertise to support a high-visibility federal mission. You will lead investigations across hybrid and multi-cloud environments, identify attacker TTPs, and drive containment in partnership with government cyber teams.

Responsibilities include end-to-end forensics across Azure AD/Entra ID, M365, AWS, GCP, and SaaS, plus creating detection playbooks and executive reports to strengthen enterprise security

Qualifications

• U.S. Citizenship and active TS/SCI clearance with DHS EOD eligibility.
• 8+ years hands-on DFIR experience and cloud forensics expertise.
• Proficiency in M365/Azure AD, AWS IAM, and SaaS investigation methods.
• Understanding of SaaS/PaaS/IaaS architectures and common attack vectors.

Responsibilities

• Conduct end-to-end forensic acquisition and analysis across on-prem, cloud, and hybrid environments.
• Investigate identity-based incidents targeting cloud control planes and hybrid identities.
• Correlate cloud telemetry and network data to reconstruct attacker timelines and IOCs.
• Develop automated detection logic and threat-hunting scripts using Sentinel, Defender, GuardDuty, and Chronicle.
• Produce technical and executive reports integrating findings across endpoints, networks, and cloud assets.

Skills

PowerShell

Python

Bash

JavaScript

Education

Bachelor's Degree in Computer Science, Cybersecurity, or related field

High School Diploma with 10+ years of directly relevant DFIR experience

Tools

Terraform

Kubernetes

Docker

CloudFormation

Azure Resource Manager

Job description

Argo Cyber Systems is seeking Cyber Network Defense Analysts with deep Cloud Forensics expertise to support a high-visibility federal mission. You will lead investigations across hybrid and multi-cloud environments, identify attacker TTPs, and drive containment in partnership with government cyber teams.

Responsibilities include end-to-end forensics across Azure AD/Entra ID, M365, AWS, GCP, and SaaS, plus creating detection playbooks and executive reports to strengthen enterprise security