Senior Host Forensics Lead - TS/SCI

ARGO Cyber Systems; Arlington (VA); On-site; USD 120,000 - 140,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401K

Job summary

ARGO Cyber Systems in Arlington, VA seeks a Senior Host Forensics Analyst to support a critical federal mission. You will apply digital forensics, incident response, and host-based investigations to collect, preserve, examine, and report on digital evidence onsite.

The role requires an active TS/SCI clearance, strong technical writing, leadership of forensic teams, and frequent travel across the United States.

Qualifications

• U.S. Citizenship required.
• Active TS/SCI security clearance required.
• Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline; or High School Diploma/GED with 10+ years of host or digital forensics experience.
• Minimum 8 years of directly relevant experience conducting cyber forensic investigations using industry-standard forensic tools and leading-edge technologies.
• Demonstrated experience conducting host-based and/or digital forensic investigations.
• Experience creating forensically sound duplicates and forensic images of computer systems.
• Demonstrated ability to produce comprehensive cyber investigative reports documenting digital forensic findings.
• Experience analyzing and characterizing cyber attacks and related digital evidence.
• Knowledge of proper digital asset collection, preservation, handling, and chain-of-custody procedures.
• Demonstrated ability to identify different classes of cyber attacks and stages of compromise.
• Knowledge of system and application security threats, vulnerabilities, and attack methodologies.
• Knowledge and experience conducting proactive analysis of systems and networks, including establishing trust levels for critical resources.
• Strong technical writing, analytical, communication, and presentation skills.
• Ability to work collaboratively with geographically dispersed teams and stakeholders.
• Ability and willingness to travel extensively to support onsite incident response engagements.

Responsibilities

• Assist federal leads with overseeing and leading forensic teams during onsite engagements, including coordinating data collection and acquisition operations.
• Provide technical guidance on data collection methods, digital forensic procedures, and investigative techniques to appropriate personnel.
• Plan, coordinate, and direct the inventory, examination, and comprehensive technical analysis of computer systems, hosts, and digital artifacts.
• Create and maintain forensically sound duplicates and images of computer systems and digital evidence.
• Support forensic analysis and mentor junior personnel on data collection, evidence analysis, investigative methodologies, and technical reporting.
• Assist with leading and coordinating forensic teams during preliminary investigations and onsite incident response engagements.
• Conduct technical analysis of digital evidence to identify indicators of compromise, malicious activity, attack vectors, persistence mechanisms, and other artifacts associated with cyber incidents.
• Evaluate, extract, and analyze suspected malicious code and related artifacts.
• Analyze and characterize cyber attacks, including identifying attack classes, stages of compromise, tactics, techniques, and procedures.
• Ensure appropriate digital evidence collection, preservation, documentation, and chain-of-custody procedures are followed.
• Write comprehensive technical reports documenting forensic findings, investigative methodologies, analysis, and conclusions.
• Distill complex analytic findings into clear executive summaries and detailed technical reports for leadership and stakeholders.
• Conduct peer reviews and quality assurance reviews of forensic products and reports, particularly those prepared by junior personnel.
• Serve as a technical forensics liaison to customers and stakeholders, explaining investigative findings, forensic methodologies, protocols, and supporting evidence.
• Track and document onsite incident response activities and provide regular status updates to federal leadership throughout an engagement.
• Conduct proactive analysis of systems and networks, including evaluating and establishing trust levels for critical resources.
• Collaborate effectively with forensic, cybersecurity, incident response, and customer teams operating across multiple physical locations.
• Travel to incident response locations throughout the United States, U.S. Territories, and Possessions as required

Skills

Host Forensics

Digital Forensics

Incident Response

Technical Writing

Team Leadership

Education

Bachelor's degree in Computer Science, Cybersecurity, Computer Engineering, or related field

Tools

EnCase

SIFT

X-Ways

Volatility

Wireshark

Sleuth Kit / Autopsy

Magnet AXIOM Cyber

Snort

Splunk / SIEM tools

EDR platforms (CrowdStrike, MDE, Trellix)

Job description

ARGO Cyber Systems in Arlington, VA seeks a Senior Host Forensics Analyst to support a critical federal mission. You will apply digital forensics, incident response, and host-based investigations to collect, preserve, examine, and report on digital evidence onsite.

The role requires an active TS/SCI clearance, strong technical writing, leadership of forensic teams, and frequent travel across the United States.