Sr. Forensics Analyst- Threat Hunter

Sr. Forensics Analyst-Threat Hunter
Washington, D.C.| Full-time

Cybervance is an equal opportunity employer that designs, develops, and manages the successful execution of training programs for government and private sector organizations. Cybervance believes in creating innovative solutions to deliver measured results.

We are looking for a Senior Forensics Analyst with an active Secret Clearance for an on-site team located in Washington, D.C.

Responsibilities
Responsibilities include, but are not limited to:

• Identify threat tactics, methodologies, gaps, and shortfalls aligned with the MITRE ATT&CK Framework and the Azure Threat Research Matrix (ATRM).
• Perform Hypothesis-based or Intelligence-based Cyber Threat Hunts to identify threats and risks within environments.
• Use cloud-native techniques and methods to identify and create threat detections for automated response activities.
• Use Agile methodology to organize intelligence, hunts, and project status.
• Be able to independently research intelligence reports to find actionable data for conducting intel or hypothesis-based hunts.
• Explore and correlate large data sets to uncover novel attack techniques, monitor and catalog changes in activity group tradecraft, and investigate alerts for enterprise customers.
• Analyze log files, evidence, and other information to determine the best methods for identifying the perpetrator(s) of a network intrusion.
• Confirm what is known about an intrusion and discover new information, if possible, after identifying the intrusion via dynamic analysis.
• Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is not unintentionally modified, to use for data recovery and analysis processes.
• Provide a technical summary of findings per established reporting procedures.
• Ensure that the chain of custody is followed by all digital media acquired by the Federal Rules of Evidence.
• Recognize and accurately report forensic artifacts indicative of a particular operating system.
• Extract data using data carving techniques (e.g., Forensic Tool Kit [FTK], Foremost).
• Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.

Qualifications

• Bachelor’s degree or higher
• 10+ years of experience performing cyber threat hunting and forensics support for incident response.
• Certifications addressing identification of malicious system and user activity, incident response in an enterprise environment, timeline artifact analysis, timeline collection, timeline processing, volatile data collection, analysis of profiling of systems and devices, analysis of file and program activity, acquisition, preparation, and preservation of digital evidence, analysis of user communications, advanced IDS concepts, applications protocols, concepts of TCP/IP and the link layer, DNS, fragmentation, IDS fundamentals and initial deployment (e.g., snort, bro), IDS rules (e.g., snort, bro), IPv6, network architecture and event correlation, network traffic analysis and forensics, or packet engineering.
• Active Secret clearance
• 5+ years of experience in digital forensics and incident response, and threat hunt activities.
• Core Competencies in Computer Forensics, Computer Network Defense, Software Testing and Evaluation, System Administration, and Threat Analysis.
• All access to classified information will be within government-controlled secure facilities.
• Strong written and verbal communication skills.
• Create detections and automation to detect, contain, eradicate, and recover from security threats.
• Develop new and novel defense techniques to identify and stop advanced adversary tactics and techniques.
• Perform forensics on network, host, memory, and other artifacts originating from multiple operating systems, applications, or networks and extract IOCs (Indicators of Compromise) and TTPs (Tactics, Techniques, and Procedures).
• Conduct proactive hunts through enterprise networks, endpoints, or datasets to detect malicious, suspicious, or risky activities that have evaded detection by existing tools.
• Advanced knowledge of TCP/IP networking, and network services such as DNS, SMT