Cyber Digital Investigator (Hybrid)

Requisition Id 15313 

 

­­Overview:  

We’re hiring a Cyber Digital Investigator who will focus on conducting digital investigations, forensic analysis, incident response activities, and advancing cyber engineering enhancements to strengthen ORNL’s security posture. This position resides in the Cyber Enhancement Group in the Cybersecurity Division, in the Information Technology Services Directorate at Oak Ridge National Laboratory (ORNL).  

 

Major Duties/Responsibilities: 

• Conduct digital and forensic investigations, including malware analysis, forensic imaging, and response to authorized investigative requests.
• Develop and modify tools to analyze forensic data, ensuring accuracy and reliability of results.
• Create and test threat hunting hypotheses, scope missions, and perform proactive detection activities.
• Use Endpoint Detection and Response (EDR) tools to write new detection rules, investigate threats, and resolve alerts.
• Participate in penetration testing activities and cybersecurity exercises.
• Collaborate with cyber security, network, data center operations, security operations center, cyber security research, and other groups to ensure effective integration and implementation of security tools.
• Standardize, document, maintain, and automate processes for monitoring, analyzing, responding to, and reporting cybersecurity events.
• Provide technical support for cyber capability enhancements, integrating operations and research outcomes.
• Develop tactical, ad hoc scripts to supplement existing forensic and investigative toolsets.
• Extract and correlate large data sets using Elastic Stack and related technologies.
• Utilize and manage SIEM (Elastic), EDR (Endgame), EnCase, FTK, F-Response, CASB/SASE, vulnerability scanning tools, and other forensic and security platforms.
• Review and recommend secure implementation strategies for both business systems and Industrial Control Systems (ICS).
• Prepare findings, documentation, and reports for authorized stakeholders.
• Deliver ORNL’s mission by aligning behaviors, priorities, and interactions with our core values of Impact, Integrity, Teamwork, Safety, and Service. Promote equal opportunity by fostering a respectful workplace – in how we treat one another, work together, and measure success.

 

Basic Qualifications:

• A BS degree in computer science, computer engineering, information technology, information systems, science, engineering, business, or a related discipline and a minimum of five (5) to seven (7) years of aligned professional experience is required for consideration. An overall combination of equivalent education and experience may be considered.

• Masters and PhD degree holders in the same fields of study are also encouraged to apply:
• Masters’ holders should have a minimum of four (4) to six (6) years of relevant and aligned experience.
• PhD holders should have up to three (3) years of relevant and aligned experience.

• Demonstrated background in digital forensics, with the ability to articulate investigative methodology across scenarios.
• Experience in SIEM administration, particularly Elastic Stack.
• Familiarity with forensic tools including EnCase, FTK, F-Response, and open-source platforms.
• Knowledge of MITRE ATT&CK methodology.

 

Preferred Qualifications:

• Excellent written and oral communication skills.
• Motivated self-starter with the ability to work independently and to participate creatively in collaborative teams across the laboratory.
• Ability to function well in a fast-paced research environment, set priorities to accomplish multiple tasks within deadlines, and adapt to ever changing needs.

 

 

Special Requirements:  

• Visa sponsorship is not available for this position.

• This position requires the ability to obtain and maintain clearance from the Department of Energy. As such, this position is a Workplace Substance Abuse (WSAP) testing designated positi