Senior Digital Forensics & Incident Response Examiner

Booz Allen Hamilton; Washington (District of Columbia); On-site; USD 113,000 - 257,000; Full time

Job summary

Booz Allen Hamilton in Washington, DC is seeking a Digital Forensic Examiner to join the DFIR team. You will handle intermediate to advanced DFIR matters, collect and analyze forensic data, and present findings to clients and counsel.

You will work with senior leads and review junior staff as needed. The role requires strong analytical skills, experience with Windows and Mac/Linux systems, and scripting (PowerShell/Python) within a formal incident response framework.

Qualifications

• Experience with full lifecycle case management of large-scale investigations.
• Experience with Windows and Mac/Linux systems and scripting (PowerShell or Python).
• Experience in forensic and incident response methodology.
• Ability to write reports and communicate with counsel, client leadership, and high-level management.
• Ability to work independently in highly collaborative team environments.
• Ability to identify IOCs from forensic data and logs.

Responsibilities

• Assist with scoping calls for potential new matters.
• Generate necessary paperwork and data entry for new matters.
• Manage cyber incident response investigations requiring forensic, malware, and log analysis.
• Collect and analyze forensic images and triage datasets to identify malware and actions taken.
• Collect and analyze malware and logs from various sources.
• Provide analysis results for senior level review, both written and verbal to clients.

Skills

Digital forensics

Incident response

Forensic analysis

PowerShell / Python

Documentation & reporting

Education

Bachelor’s degree

Tools

EnCase

FTK

Axiom

Splunk

ELK Stack

Job description

Booz Allen Hamilton in Washington, DC is seeking a Digital Forensic Examiner to join the DFIR team. You will handle intermediate to advanced DFIR matters, collect and analyze forensic data, and present findings to clients and counsel.

You will work with senior leads and review junior staff as needed. The role requires strong analytical skills, experience with Windows and Mac/Linux systems, and scripting (PowerShell/Python) within a formal incident response framework.