Host Based Analyst III

Responsibilities

• Aiding Federal leads in overseeing and leading forensic teams at onsite engagements by coordinating data collection/acquisition operations.
• Providing technical assistance on data collection techniques and forensic investigative techniques to appropriate personnel when necessary.
• Writing in-depth reports and supporting with peer reviews and providing quality assurance reviews for junior personnel.
• Serving as a mentor and providing guidance to others on data collection, analysis, and reporting in support of onsite engagements.
• Leading and coordinating forensic teams in preliminary investigation, planning, coordinating, and directing the inventory, examination, and comprehensive technical analysis of computer systems and digital artifacts.
• Distilling analytic findings into executive summaries and in-depth technical reports.
• Serving as a technical forensics liaison to stakeholders and explaining investigation details, including forensic methodologies and protocols.
• Tracking and documenting on-site incident response activities and providing updates to leadership throughout the engagement.
• Traveling to incident response locations in the United States, Territories & Possessions.
• Evaluating, extracting, and analyzing suspected malicious code.

Required Skills

• U.S. Citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• At least 8 years of directly relevant experience in cyber forensic investigations using leading edge technologies and industry standard forensic tools.
• Ability to create forensically sound duplicates of computer systems (forensic images).
• Experience with the analysis and characterization of cyber attacks.
• Experience with proper digital asset collection and preservation procedures and chain of custody protocols.
• Knowledge of system and application security threats and vulnerabilities.
• Proactive analysis of systems and networks, including creating trust levels of critical resources.
• Ability to work collaboratively across physical locations.

Desired Skills

• Experience with or knowledge of two or more of the following tools: EnCase, SIFT, X-Ways Volatility, WireShark, Sleuth Kit/Autopsy, Magnet, Axiom, Cyber, Snort, Splunk, or other SIEM Tools (ArcSight, LogRythm, Elastic, etc.), or other EDR Tools (Crowdstrike, MDE, Trellix, etc.).
• Proficiency with conducting all-source research.

Required Education

BS in Computer Science, Cybersecurity, Computer Engineering, or related degree; or HS Diploma and 10+ years of host or digital forensics experience.

Desired Certifications

• GCFA
• GCFE
• EnCE
• CCE
• CFCE
• CISSP