Senior Network Forensics & Incident Response Investigator

Forensic Focus; Arlington (VA); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Forensic Focus is seeking an experienced network forensics/incident response expert to support a federal hunt and incident response team. You will analyze network traffic, logs and device configurations to detect anomalies and reconstruct attacker activity during on-site and remote engagements.

The role requires deep knowledge of Cisco, Ivanti, Palo Alto, Ciena and Juniper, plus PCAP, flow data, DNS and proxy log analysis, network topology assessment and threat actor TTPs.

Qualifications

• Deep expertise in edge-device technologies from leading vendors.
• Strong capabilities in network traffic and log analysis for incident response.
• Experience interfacing with government clients on high-pressure investigations.

Responsibilities

• Investigate cyber intrusions affecting critical infrastructure.
• Analyze network traffic, logs and device configurations to detect anomalies.
• Reconstruct attacker activity and advise on containment and eradication.
• Lead technical analysis during on-site and remote engagements.

Skills

PCAP analysis

Flow data analysis

DNS analysis

Proxy log analysis

Network topology assessment

Threat actor TTPs

Device integrity validation

Tools

Cisco

Ivanti

Palo Alto

Ciena

Juniper

Job description

Forensic Focus is seeking an experienced network forensics/incident response expert to support a federal hunt and incident response team. You will analyze network traffic, logs and device configurations to detect anomalies and reconstruct attacker activity during on-site and remote engagements.

The role requires deep knowledge of Cisco, Ivanti, Palo Alto, Ciena and Juniper, plus PCAP, flow data, DNS and proxy log analysis, network topology assessment and threat actor TTPs.