o

o

o

Responsibilities:

· Assisting Federal leads with overseeing and leading forensic teams at onsite engagements by coordinating data collection/acquisition operations

· Providing technical assistance on data collection techniques and forensic investigative techniques to appropriate personnel when necessary

· Writing in-depth reports, supports with peer reviews and provides quality assurance reviews for junior personnel

· Supporting forensic analysis and mentoring/providing guidance to others on data collection, analysis and reporting in support of onsite engagements.

· Assisting with leading and coordinating forensic teams in preliminary investigation

· Planning, coordinating and directing the inventory, examination and comprehensive technical analysis of computer systems and digital artifacts.

· Distilling analytic findings into executive summaries and in-depth technical reports

· Serving as technical forensics liaison to stakeholders and explaining investigation details to include forensic methodologies and protocols

· Tracking and documenting on-site incident response activities and providing updates to leadership throughout the engagement

· Traveling to incident response locations in the United States, Territories & Possessions

· Evaluating, extracting and analyzing suspected malicious code

Required Skills:

oU.S. Citizenship

oMust have an active TS/SCI clearance

oMust be able to obtain DHS Suitability

o 8+ years of directly relevant experience in cyber forensic investigations using leading edge technologies and industry standard forensic tools

o Ability to create forensically sound duplicates of computer systems (forensic images)

o Able to write cyber investigative reports documenting digital forensics findings

o Experience with the analysis and characterization of cyber attacks

o Experience with proper digital asset collection and preservation procedures and chain of custody protocols

o Skilled in identifying different classes of attacks and attack stages

o Knowledge of system and application security threats and vulnerabilities

o Knowledgeable in proactive analysis of systems and networks, to include creating trust levels of critical resources

o Must be able to work collaboratively across physical locations.

Desired Skills:

· Experience with or knowledge of two or more of the following tools:

· EnCase

· SIFT

· X-Ways

· Volatility

· WireShark

· Sleuth Kit/ Autopsy

· Magnet Axiom Cyber

· Snort

· Splunk or other SIEM Tools (ArcSight, LogRythm, Elastic, Etc.)

· Other EDR Tools (Crowdstrike, MDE, Trellix, Etc)

· Proficiency with conducting all-source research.

Required Education:

BS Computer Science, Cybersecurity, Computer Engineering or related degree; or HS Diploma and 10+ years of host or digital forensics experience

Desired Certifications:

GCFA, GCFE, EnCE, CCE, CFCE, CISSP