Senior Network Forensics Analyst Onsite Incident Response

Nightwing; Sterling (VA); On-site; USD 77,000 - 163,000; Full time

Job summary

Nightwing is seeking a Network Forensics Analyst to support a U.S. Government customer onsite in the Arlington, VA region. You will investigate incidents, collect PCAPs and artifacts, and help develop remediation plans while coordinating with Government leads.

Qualified candidates bring deep TCP/IP, MITRE ATT&CK, and SIEM experience, plus ability to work across locations. U.S. citizenship and an active TS/SCI clearance are required.

Qualifications

• U.S. Citizenship required.
• Active TS/SCI clearance required.
• 5+ years in network investigations.
• In-depth TCP/IP and protocol knowledge.
• Ability to work across physical locations.

Responsibilities

• Assists the Government lead in coordinating teams in preliminary incident response investigations.
• Assists with interfacing with the customer on site.
• Determines appropriate courses of action in response to anomalous network activity.
• Assesses network topology and device configurations for security concerns.
• Assists writing and publishing CND guidance and incident reports.
• Collects network intrusion artifacts (PCAP, domains, URIs, certificates).
• Analyzes malicious network activity to identify exploitation methods and effects.
• Collects and analyzes network device integrity data for tampering signs.
• Supports real-time CND incident handling on onsite engagements.

Skills

Network investigations

TCP/IP knowledge

SIEM knowledge

MITRE ATT&CK

Team collaboration

Network topology

Network analysis

Wireless networking

Education

BS in CS/Cyber or related

HS Diploma + 7-9 years exp

Tools

Wireshark

PCAP analysis

Network analysis tools

Job description

Nightwing is seeking a Network Forensics Analyst to support a U.S. Government customer onsite in the Arlington, VA region. You will investigate incidents, collect PCAPs and artifacts, and help develop remediation plans while coordinating with Government leads.

Qualified candidates bring deep TCP/IP, MITRE ATT&CK, and SIEM experience, plus ability to work across locations. U.S. citizenship and an active TS/SCI clearance are required.