Lead Cyber Defense Forensics Analyst

About the role

Lead Cyber Defense Forensics Analyst at Revolutional, you are the program’s most senior forensic practitioner. You own the most complex investigations, set the technical standard for forensic methodology, and serve as the subject matter authority on computer forensics, network analysis, and evidentiary handling across the cyber defense mission.

Responsibilities

• Lead digital forensic investigations of the highest technical complexity; conduct end-to-end analysis from evidence acquisition through findings documentation within classified, government-controlled secure facilities
• Conduct host-based forensic analysis: disk and memory acquisition, file system examination, artifact recovery, malware triage, and attack timeline reconstruction across Windows and Linux environments
• Conduct network forensic analysis: packet capture review, NetFlow correlation, log analysis, and identification of lateral movement, exfiltration, and command-and-control activity
• Maintain strict chain of custody for all evidence collected and handled; ensure all forensic work meets applicable federal legal and evidentiary standards
• Provide direct analytical support to incident response operations; contribute forensic findings that drive containment, eradication, and recovery decisions in real time
• Support threat hunt activities with forensic analysis: investigate hunt leads, validate hypotheses, and extract IOCs that feed detection improvements
• Apply Software Testing and Evaluation methodology to validate forensic tools and assess new capabilities before operational deployment
• Apply system administration knowledge across Windows and Linux environments to scope investigations, interpret artifacts, and assess attacker activity accurately
• Apply Threat Analysis tradecraft to map forensic findings to adversary TTPs using MITRE ATT&CK and other structured frameworks
• Produce thorough, legally defensible forensic reports documenting methodology, findings, evidence handling, and recommended response actions
• Ensure compliance with NICE Cybersecurity Workforce Framework IN-FOR-002 role definition; maintain current awareness of adversary tradecraft, malware families, forensic evasion techniques, and emerging investigation methodologies

Requirements

• Bachelor’s degree in Computer Science, Digital Forensics, Information Security, or related field (or equivalent experience)
• 5 to 7 years of hands-on experience in digital forensics, incident response, and threat hunting, with demonstrated lead-level technical proficiency
• Active Top Secret/SCI clearance (Final) required
• Must work onsite within a government-controlled secure facility
• Expert-level Computer Forensics: disk and memory acquisition, file system and artifact analysis, malware triage, timeline reconstruction, and chain of custody management to legal and evidentiary standards
• Core competency in Computer Network Defense: intrusion detection, alert triage, network traffic analysis, and defensive posture assessment applied to forensic investigation scoping and findings
• Experience with Software Testing and Evaluation applied to forensic tool validation, capability testing, and pre-deployment assessment of new investigation technologies
• Working knowledge of System Administration across Windows and Linux environments sufficient to accurately scope investigations, interpret system artifacts, and reconstruct attacker activity
• Core competency in Threat Analysis: MITRE ATT&CK-based TTP mapping, threat actor profiling, and structured analytic frameworks applied to forensic findings
• Proficiency with industry-standard forensic tools: EnCase, FTK, Autopsy, Volatility, Wireshark, or equivalent
• Experience operating within the NICE Cybersecurity Workforce Framework IN-FOR-002 role definition; current on applicable role-based training requirements

Qualifications

• One or more of the following is required or strongly preferred: GCFA (GIAC Certified Forensic Analyst), GCFE (GIAC Certified Forensic Examiner), EnCE (EnCase Certified Examiner), CFCE (Certified Forensic Computer Examiner), or GCIH (GIAC Certified Incident Handler)
• Role-based training required per NICE Cybersecurity Workforce Framework IN-FOR-002 — must be current or completed within required timeframes

Skills

• Technically elite forensic practitioner — your investigations are thorough, your methodology is sound, and your findings hold up under legal and operational scrutiny
• Analytically independent: you take complex, ambiguous investigations and drive them to conclusion without needing the situation pre-defined
• Rigorous in classified environments — chain of custody, access controls, and handling requirements are instinctive, not procedural
• Effective technical contributor to incident response and threat hunt teams; your forensic findings accelerate the broader mission, not just your own workstream

Benefits

Here At Revolutional We Are Pleased To Have Been Repeatedly Recognized For Our Outstanding Work Culture, The Innovative Work We Do, And The Employees On Our Team Who Make a Difference Each Day. Some Of These Recognitions Include Recognized as a Top 20 "Best Place to Work in Virginia"Recipient of Department of Labor's HireVets Gold MedallionGreat Place to Work Certification for five years runningA Virginia Chamber of Commerce Fantastic 50 companyA Northern Virginia Technology Council Tech 100 company Inc. 5000 list of fastest growing companies for eleven yearsTwo-time SBA SBIR Tibbett's Award winnerVirginia Values Veterans (V3) Certification

We recognize that every bit of our success is the result of our teams of hard-working, motivated, and innovative professionals who are proud to call themselves part of the Revolutional family! In addition to competitive compensation, a family-focused culture, and a dynamic, productive work environment, we offer all full-time employees a variety of benefits including, but not limited to:

• Traditional and HSA-eligible medical insurance plans
• 100% employer-paid dental and vision insurance options
• 100% employer-sponsored STD, LTD, and life insurance
• 5% 401(k) company matching
• Flexible-schedules and teleworking options
• Paid holidays and PTO Accrual Plans
• Paid Parental Leave
• Professional development and career growth opportunities
• Team and company-wide events, recognition, and appreciation-- and so much more!

Pay

TBD

Schedule

TBD