Senior Network Forensics Analyst - Incident Response

Nightwing Group; Arlington, Northern (VA, KY); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Nightwing Group seeks a Cyber Network Forensic Analyst III to support a U.S. Government client in Arlington, VA. You will lead on-site incident response, coordinate with government teams, and determine containment and remediation steps for breaches.

The role requires U.S. citizenship and an active TS/SCI clearance with DHS suitability, plus 8+ years in network investigations. You will analyze traffic, collect artifacts (PCAPs, domains, URIs, certificates) and support real-time defense operations.

Qualifications

• U.S. citizenship required with active TS/SCI clearance.
• 8+ years of directly relevant experience in network investigations.
• Experience with CND policies, procedures, and MITRE ATT&CK.
• Strong knowledge of TCP/IP and common network protocols.
• Ability to work across multiple physical locations.

Responsibilities

• Assist Government lead with coordinating teams in preliminary incident response investigations.
• Assist with interfacing with the customer on site.
• Analyze anomalous network activity to determine containment actions.
• Collect network artifacts (PCAPs, domains, URIs, certificates) to mitigate incidents.
• Support on-site CND incident handling, threat analysis, and remediation advice.

Skills

TS/SCI clearance

8+ years network investigations

MITRE ATT&CK knowledge

CND knowledge

TCP/IP protocols

Cross-location collaboration

Education

BS Computer Science, Cyber Security, Computer Engineering, or related degree

HS Diploma & 10+ years of network investigations experience

Tools

Splunk

Wireshark

PCAP analysis

Job description

Nightwing Group seeks a Cyber Network Forensic Analyst III to support a U.S. Government client in Arlington, VA. You will lead on-site incident response, coordinate with government teams, and determine containment and remediation steps for breaches.

The role requires U.S. citizenship and an active TS/SCI clearance with DHS suitability, plus 8+ years in network investigations. You will analyze traffic, collect artifacts (PCAPs, domains, URIs, certificates) and support real-time defense operations.