Cyber Digital Investigator & National Security Liaison

Requisition Id 15327 

Level: TP01

 

­­Overview:  

Oak Ridge National Laboratory seeks a Cyber Digital Investigator & National Security Liaison to join the Cyber Enhancements group to assist with digital investigations, forensics, incident response, and liaison to national security elements.

 

This position will support all aspects of Cyber Enhancements to include technical advice, design, and implementation of innovative projects, though primary duties will be to conduct digital investigations and forensics for incident response, threat hunting, authorized support of external entity investigations, and cyber engineering enhancements as required. The candidate will also work collaboratively with the counterintelligence office and other national security elements.  The candidate will be expected to have experience conducting digital investigations and formal training or certifications in appropriate field. Experience in law enforcement investigative techniques will be adequately weighed.

 

Major Duties/Responsibilities: 

• Conduct digital and forensics investigations, to include malware analysis, image capturing and analysis for incident response, and other investigations as necessary by request of authorized officials
• Help develop and modify tools to analyze forensic data and provide accurate information for activity review, to include remote access.
• Ability to create threat hunting hypotheses, then plan and scope Threat Hunting missions
• Participate in penetration testing activities and exercises
• Extract and correlate large data sets (Elastic)
• Serve as a liaison to the DOE Counterintelligence Office and other national security elements.
• Provides a communication pathway for classified and unclassified intelligence that information owners and network defenders need to protect DOE assets. Disseminates information to the USIC regarding foreign cyber activity against DOE.
• Uses data analysis techniques to identify insider threat and other malicious cyber activity based on cyber security information. Creates and modifies tools that access data in various formats and produces analytical reports or visualizations.
• Makes value-added contributions that affect the successful integration of DOE efforts with those of the USIC, especially in the USIC-wide cyber investigations.
• Provides consultation and advice on a broad range of cyber questions such as scope of problem to be investigated, issues involved, possible lines of attack, pertinent technology available, required liaison or joint projects with other organizations, objectives to be sought, and security considerations to be observed.
• Supports all cyber activities regarding intrusion incidents into classified and unclassified computer systems. In coordination with computer security officials and appropriate law enforcement entities, analyzes and evaluates available information to determine foreign intelligence organization involvement and determines protective actions to be taken.
• Deliver ORNL’s mission by aligning behaviors, priorities, and interactions with our core values of Impact, Integrity, Teamwork, Safety, and Service.

 

Basic Qualifications:

• Bachelor’s degree with a concentration in Computer Science, Cyber, or Forensics, with 5 years of experience in investigative techniques and experience in cyber or related field. Experience / certifications in digital forensics and investigations. A combination of education and experience may be considered for exceptional candidates with background in engineering, programming, and investigative techniques, and who possess an active security clearance.
• The duties require extensive knowledge of information technology and cyber security topics, including network traffic analysis, log processing, and cyber security visualization. 
• Programming and data analysis skills are required. Familiarity with the following would be considered baseline skills: Perl, Python, or similar programming/scripting languages; relational and non-relational databases (MongoDB), SQL; system administration skills (Windows, Linux, VMs).
• Strong familiarity with DOE programs and locations and the nature of the foreign technical intelligence threat directed against them is required.
• Candidate must have significant experience performing work in the collection, investigation, analysis, evaluation, interpretation and