Senior Cloud Forensics & IR Analyst

ARGO Cyber Systems; Arlington (VA); Hybrid; USD 130,000 - 160,000; Full time

Job summary

Argo Cyber Systems is seeking a Cyber Network Defense Analyst with Cloud Forensics experience to support critical missions. You will conduct forensic analysis across on-premises and cloud platforms, investigate incidents, and develop automated detection using Defender/Sentinel and cloud tools. Role requires strong scripting, cloud expertise, and a TS/SCI access approach with U.S.

citizenship. The team collaborates with government and internal stakeholders to validate alerts and drive containment

Qualifications

• 8+ years of experience in cyber forensic investigations.
• U.S. Citizenship required; TS/SCI clearance preferred.
• Experience with cloud environments (SaaS/PaaS/IaaS) and hybrid identity security.

Responsibilities

• Conduct forensic acquisition and analysis from on-premises and cloud platforms (Entra ID/Azure AD, M365, AWS, GCP, SaaS).
• Investigate and respond to incidents targeting cloud and hybrid identity.
• Correlate cloud control-plane events and network telemetry to reconstruct attacker timelines.
• Develop and operationalize detection logic and automation using cloud-native tools and scripting.
• Produce incident reports and containment recommendations; support IR playbooks for cloud/hybrid environments.
• Coordinate with internal teams and external stakeholders.

Skills

Cloud forensics

Incident response

Threat hunting

Forensic investigations

PowerShell/Python scripting

Tools

Microsoft Defender

Sentinel

AWS GuardDuty

GCP Chronicle

Job description

Argo Cyber Systems is seeking a Cyber Network Defense Analyst with Cloud Forensics experience to support critical missions. You will conduct forensic analysis across on-premises and cloud platforms, investigate incidents, and develop automated detection using Defender/Sentinel and cloud tools. Role requires strong scripting, cloud expertise, and a TS/SCI access approach with U.S.

citizenship. The team collaborates with government and internal stakeholders to validate alerts and drive containment