Jobs and Careers
CF
Cyber Incident Response and Forensic Analyst (Senior)
cFocus Software IncorporatedWashington, United Statesfull_timeVerifiedPosted 15 Jan 2025
About the role
cFocus Software seeks a Cyber Incident Response Analyst (Senior) to join our program supporting US Courts in Washington, DC. This position has remote capabilities. This position requires an active Public Trust clearance and must meet 8570 requirements.
Required Qualifications include:
Required Qualifications include:
- 5 years of experience analyzing forensic artifacts, performing filesystem timeline analyses, and identifying intrusion root causes of operating systems (e.g., Windows, Linux, and macOS)
- 5 years of experience utilizing the following forensics tools:
- Magnet AXIOM to acquire, analyze, and report on digital evidence;
- SANS SIFT Workstation for disk/memory analysis, network forensics, and malware analysis;
- Encase to collect, analyze, and report on digital evidence;
- Velociraptor to collect and analyze data from multiple endpoints;
- KAPE (Eric Zimmerman’s tools) to collect and process files;
- SUMURI TALINO Workstations/Laptops
- Cellebrite
- Bi-Weekly Threat Assessment Reports (BTARs)
- Must have ability to perform required forensics/malware analyst duties, including:
- Create duplicates of evidence that ensure the original evidence is not unintentionally modified;
- Extracting deleted data using data carving techniques
- Performing static and dynamic malware analysis to discover indicators of compromise (IOCs)
- Must be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC
- One of the following certifications:
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Certified Incident Handler (GCIH)
- GIAC Continuous Monitoring (GMON)
- GIAC Defending Advanced Threats (GDAT)
- Splunk Core Power User
- Provides digital forensics and incident response support to the AOUSC Security Operations Center (SOC). Collects, analyzes, and evaluates forensic artifacts associated with threat activity against Judiciary networks. Products created by the analyst assist the SOC and the Courts in understanding the nature and impact of cyber incidents, allowing for informed decision making in prioritizing, addressing, and mitigating risk across the Judicial Branch of Government.
- Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now) for advanced subject matter expert (SME) technical investigative support for real-time incident response (IR). IR includes cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (e.g., Zscaler).
- Create duplicates of evidence that ensure the original evidence is not unintentionally modified. AOUSC supplied procedures and tools shall be used to acquire the evidence.
Apply for this role
Generate a tailored application kit with a matched cover letter, interview prep, and CV highlights — in under 60 seconds.
Apply Now →Generate Application KitFree account required — sign up in 30s