Senior Forensic and Malware Analyst Top Secret/SCI w/Poly

Peraton; Georgia; On-site; USD 120,000 - 170,000; Full time

Job summary

Peraton is seeking a Senior Forensic and Malware Analyst to support ARCYBER G3 at Fort Gordon, GA. The role focuses on malware analysis, reverse engineering, and digital forensics across static, dynamic, and hybrid techniques.

Candidates should hold required IA certifications, be a US citizen, and possess TS/SCI with Poly eligibility. The team collaborates with mission partners to contextualize threats and develop detection content.

Qualifications

• Requires high-level security clearances and US citizenship.
• Minimum years of experience by degree; alternative HS/Associates paths.
• Experience with malware analysis, static/dynamic/hybrid techniques.
• Ability to examine suspicious software and perform reverse-engineering.

Responsibilities

• Update FMA SOPs, TTPs, CSSP, and website information.
• Contextualize malware findings with partners and intelligence professionals.
• Conduct malware analysis/reverse engineering of compiled and non-compiled malware content.
• Develop/write malware detection signatures (e.g., YARA) and threat-hunting artifacts.
• Conduct dead-box and live forensic analysis; collect and transfer forensic evidence.
• Perform network forensics by inspecting PCAPs for indicators and anomalies.
• Conduct mobile device forensics using dedicated lab tools.

Skills

PowerShell

Python

Bash

Malware analysis

Reverse engineering

Forensics

Education

BS/BA in STEM

MS/MA in STEM

PhD in STEM

High School + 16 yrs exp

Associates +14 yrs exp

Tools

CCNA-Security

CCNA-Cybersecurity

CySA+

GICSP

GSEC

Security+

CND

SSCP

Job description

Required Qualifications:

• Minimum of 12 years with BS/BA; Minimum of 10 years with MS/MA; Minimum of 7 years with a PhD. Will consider HS with 16 years of relevant experience or Associates degree with 14 years of experience
• Must have an IA certification upon start: CCNA-Security, CCNA-Cybersecurity, CySA+, GICSP, GSEC, Security+, CND, or SSCP
• Able to support surge operations if mission requires
• Experience with scripting languages (e.g., PowerShell, BASH, Python, etc.) for automating analysis tasks, parsing artifacts, or developing tooling in support of malware or forensic workflows
• Able to examine suspicious or malicious software—using static, dynamic, and hybrid techniques
• Experienced in conducting analysis of malicious software to determine what it does, how it works, and how to detect, contain, and remove it
• Experience with dead-box (static) forensic analysis and live (dynamic) forensic/incident handling analysis
• Able to perform reverse-engineering on executable code and analysis of non-compiled malicious content such as scripts, encoded commands, macros, and obfuscated files
• Experience with DOD standards of reporting
• Skilled in inspecting packet captures (PCAPs) for domains, URI paths, protocols, User Agent strings, TLS metadata, and other artifacts that may indicate compromise
• US Citizenship is required
• Active TS with ability to obtain/maintain SCI and Polygraph

Preferred Qualifications:

• Active, or previously held, GIAC Certified Forensic Analyst (GCFA) certification

Peraton seeks a Senior Forensic and Malware Analyst to support ARCYBER G3.

Location: Fort Gordon, GA.

Tasks include:

• Update FMA portions of SOPs, TTPs, CSSP, and website information
• Coordinate with internal and external mission partners and intelligence professionals to contextualize malware findings within broader adversary TTPs and campaign activity
• Conduct malware analysis/reverse engineering of compiled executable code and non-compiled malicious content in order to characterize and understand its functions and capabilities
  • Perform reverse-engineering on executable code
  • Analyze and deobfuscate scripts, encoded commands, macros, and other non-compiled malicious content (e.g., PowerShell, VBScript, batch files, Office macros) to determine intent and functionality
  • Develop and maintain malware detection signatures (e.g., YARA rules) based on analytic findings to support detection engineering and threat hunting activities
  • Develop and maintain malware analysis artifacts, case notes, and all case-related data; produce written reports of findings and deliver regular operational briefings (daily/weekly/monthly) to leadership and mission partners
• Conduct and assist in executing digital media forensics
  • Perform dead-box (static) forensic analysis and live (dynamic) forensic/incident handling analysis
  • Use static, dynamic, and hybrid analysis techniques to detect and identify anomalous and/or malicious activity/software
  • Collect, preserve, and transfer forensic evidence of intrusions to on-premises Information System(s) (IS)
  • Analyze images, suspicious/malicious files, intrusion-related artifacts, entry points/vectors
  • Perform network forensic analysis including inspection of packet captures (PCAPs) for malicious indicators, protocol anomalies, C2 communications, and other intrusion artifacts
• Conduct mobile device forensic examinations utilizing the Mobile device forensics lab
  • Leverage mobile forensics lab tools and capabilities to acquire, examine, and analyze data from mobile devices in support of forensic investigations