Senior DFIR Lead – Intrusion, Forensics & Threat Analysis

Spry Methods, Inc.; Linthicum (MD); On-site; USD 200,000 - 225,000; Full time

Job summary

Spry Methods is seeking a Digital Forensics and Incident Response (DFIR) Lead to direct all DFIR activities at a government digital forensics laboratory. This position manages the intrusion analysis and incident response staff and provides technical oversight for investigations.

You will coordinate analysis of advanced persistent threat activity across multiple data sources, brief Government leadership on findings, and ensure compliance with the PWS.

Qualifications

• TS/SCI clearance eligible with active certification such as DFE, GCFA, or GCIH.
• Minimum 7 years in DFIR with 5+ years in network intrusion analysis, malware forensics, and memory analysis.
• At least 3 years of leadership/supervisory experience directing intrusion investigations and briefing leadership.

Responsibilities

• Lead CFL Digital Forensics and Incident Response activities.
• Manage intrusion analysis and incident response personnel.
• Direct network intrusion analysis, malware forensics, and memory analysis.
• Lead intrusion investigations and monitor investigative quality and efficiency.
• Analyze advanced persistent threat activity.
• Correlate findings from host forensics, network logs, and threat intelligence.
• Brief technical findings to Government leadership.
• Ensure all intrusion and incident response activities comply with the PWS.
• Serve as the primary Government technical point of contact for intrusion analysis and incident response.

Skills

DFIR expertise

Network intrusion analysis

Malware forensics

Memory analysis

Leadership

Job description

Spry Methods is seeking a Digital Forensics and Incident Response (DFIR) Lead to direct all DFIR activities at a government digital forensics laboratory. This position manages the intrusion analysis and incident response staff and provides technical oversight for investigations.

You will coordinate analysis of advanced persistent threat activity across multiple data sources, brief Government leadership on findings, and ensure compliance with the PWS.