Senior DFIR Analyst: Incident Response & Forensics

Vtgdefense; Herndon (VA); On-site; USD 130,000 - 240,000; Full time

Job summary

VTG Defense in Herndon, VA seeks a DFIR Analyst to lead live memory analysis, disk imaging, and forensic data acquisition while enforcing strict chain-of-custody. You will map threat actor movement across endpoints and cloud, building comprehensive incident timelines and IOCs for rapid containment.

The role requires 11+ years in cybersecurity, DoD 8570 IAT Level II compliance, and hands-on experience with major forensic suites and EDR/XDR platforms.

Qualifications

• Top Secret/SCI with Polygraph clearance.
• 11+ years of Cyber Security experience with Government programs.
• 2+ years in host/network forensics, threat hunting, or Tier 3 incident response.
• Experience with EDR/XDR platforms.
• Experience analyzing host artifacts and PCAPs.

Responsibilities

• Performs live memory analysis, disk imaging, and forensic data acquisition with strict chain-of-custody protocols.
• Analyzes endpoint, cloud, and system log data to map threat actor movement and build incident timelines.
• Communicates with customer to coordinate threat containment and eradication strategies.
• Conducts threat hunting to uncover APTs and persistence mechanisms.
• Prepares detailed forensic reports and root-cause analyses to justify remediation and changes.
• Advises customer on impacts, zero-day vulnerabilities, and threat trends.
• Collaborates with cyber defense teams to deploy updates and countermeasures.
• Identifies gaps in logging architectures and provides engineering recommendations.

Skills

Threat hunting

Incident response

Communication

Forensic analysis

DoD 8570 IAT Level II

Education

BS in digital forensics / cybersecurity

BS in computer science or related IT discipline

Tools

Axiom

X-Ways

FTK

EnCase

Volatility

KAPE

Job description

VTG Defense in Herndon, VA seeks a DFIR Analyst to lead live memory analysis, disk imaging, and forensic data acquisition while enforcing strict chain-of-custody. You will map threat actor movement across endpoints and cloud, building comprehensive incident timelines and IOCs for rapid containment.

The role requires 11+ years in cybersecurity, DoD 8570 IAT Level II compliance, and hands-on experience with major forensic suites and EDR/XDR platforms.