Senior Forensic and Malware Analyst Top Secret/SCI w/Poly

Peraton; Augusta (GA); On-site; USD 135,000 - 216,000; Full time

Job summary

Peraton seeks a Senior Forensic and Malware Analyst to support ARCYBER G3. Location: Fort Gordon, GA. Responsibilities include updating SOPs and TTPs, coordinating with partners, and conducting malware analysis with reverse engineering to characterize capabilities.

Key tasks include developing YARA rules, maintaining forensics artifacts, and delivering written reports and regular briefings to leadership. The role requires extensive experience and active security clearances as listed.

Qualifications

• Requires high-level malware analysis, reverse engineering, and forensic skills.
• Proficiency with scripting for automation of analysis tasks.
• Experience with IA and security certifications is expected.

Responsibilities

• Update SOPs, TTPs, CSSP, and website information for FMA.
• Coordinate with partners to contextualize malware findings.
• Perform malware analysis and reverse-engineering of executables.
• Develop and maintain malware signatures (YARA) for detection.
• Produce case notes and written reports; brief leadership regularly.
• Conduct static and live forensic analyses and collect evidence.
• Analyze PCAPs and network artifacts for indicators of compromise.
• Perform mobile device forensics using the mobile forensics lab.

Skills

Scripting (PowerShell, Bash, Python)

Malware analysis

Reverse engineering

Static/dynamic/hybrid forensics

PCAP/network analysis

Threat hunting

Team coordination

Forensic reporting

Education

BS/BA degree

MS/MA degree

PhD

Tools

YARA

Digital forensics tooling

Job description

Responsibilities

Peraton seeks a Senior Forensic and Malware Analyst to support ARCYBER G3.

Location: Fort Gordon, GA.

Tasks include:

• Update FMA portions of SOPs, TTPs, CSSP, and website information
• Coordinate with internal and external mission partners and intelligence professionals to contextualize malware findings within broader adversary TTPs and campaign activity
• Conduct malware analysis/reverse engineering of compiled executable code and non-compiled malicious content in order to characterize and understand its functions and capabilities
  • Perform reverse-engineering on executable code
  • Analyze and deobfuscate scripts, encoded commands, macros, and other non-compiled malicious content (e.g., PowerShell, VBScript, batch files, Office macros) to determine intent and functionality
  • Develop and maintain malware detection signatures (e.g., YARA rules) based on analytic findings to support detection engineering and threat hunting activities
  • Develop and maintain malware analysis artifacts, case notes, and all case-related data; produce written reports of findings and deliver regular operational briefings (daily/weekly/monthly) to leadership and mission partners
• Conduct and assist in executing digital media forensics
  • Perform dead-box (static) forensic analysis and live (dynamic) forensic/incident handling analysis
  • Use static, dynamic, and hybrid analysis techniques to detect and identify anomalous and/or malicious activity/software
  • Collect, preserve, and transfer forensic evidence of intrusions to on-premises Information System(s) (IS)
  • Analyze images, suspicious/malicious files, intrusion-related artifacts, entry points/vectors
  • Perform network forensic analysis including inspection of packet captures (PCAPs) for malicious indicators, protocol anomalies, C2 communications, and other intrusion artifacts
• Conduct mobile device forensic examinations utilizing the Mobile device forensics lab
  • Leverage mobile forensics lab tools and capabilities to acquire, examine, and analyze data from mobile devices in support of forensic investigations

Qualifications

Required Qualifications:

• Minimum of 12 years with BS/BA; Minimum of 10 years with MS/MA; Minimum of 7 years with a PhD. Will consider HS with 16 years of relevant experience or Associates degree with 14 years of experience
• Must have an IA certification upon start: CCNA-Security, CCNA-Cybersecurity, CySA+, GICSP, GSEC, Security+, CND, or SSCP
• Able to support surge operations if mission requires
• Experience with scripting languages (e.g., PowerShell, BASH, Python, etc.) for automating analysis tasks, parsing artifacts, or developing tooling in support of malware or forensic workflows
• Able to examine suspicious or malicious software-using static, dynamic, and hybrid techniques
• Experienced in conducting analysis of malicious software to determine what it does, how it works, and how to detect, contain, and remove it
• Experience with dead-box (static) forensic analysis and live (dynamic) forensic/incident handling analysis
• Able to perform reverse-engineering on executable code and analysis of non-compiled malicious content such as scripts, encoded commands, macros, and obfuscated files
• Experience with DOD standards of reporting
• Skilled in inspecting packet captures (PCAPs) for domains, URI paths, protocols, User Agent strings, TLS metadata, and other artifacts that may indicate compromise
• US Citizenship is required
• Active TS with ability to obtain/maintain SCI and Polygraph

Preferred Qualifications:

• Active, or previously held, GIAC Certified Forensic Analyst (GCFA) certification

Peraton Overview

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can't be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we're keeping people around the world safe and secure.

Target Salary Range

$135,000 - $216,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

EEO

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.