Digital Forensics SME

Q

The Digital Forensics SME provides advanced digital forensics and incident response (DFIR) expertise, supporting investigation, analysis, and remediation of complex cybersecurity incidents across the Agency enterprise.

Responsibilities

• Perform advanced forensic analysis on endpoints, networks, and digital media.
• Identify root causes of incidents using agency-provided tools and forensic methodologies.
• Conduct malware analysis, including static and dynamic analysis techniques.
• Collect, preserve, and analyze evidence in accordance with chain-of-custody requirements.
• Produce forensic reports, indicators of compromise (IOCs), and investigative findings.
• Support incident response and remediation efforts, including hands-on technical engagement when required.
• Contribute to threat intelligence development and reporting.
• Analyze phishing campaigns, email threats, and adversary tactics.
• Support SOC operations (SOC-48) with both oversight and technical execution.
• Collaborate with law enforcement and federal partners as needed.

Qualifications

• Bachelor’s degree in cybersecurity, digital forensics, or related field.
• 8+ years of experience in digital forensics and incident response.
• Expertise in: Forensic toolsets (e.g., EnCase, FTK, X-Ways, Velociraptor, etc.), Malware analysis and reverse engineering, Network and endpoint forensics, and Experience producing evidentiary-quality documentation.