Insider Threat Analyst III (Digital Forensics)

Overview

As a Digital Forensics Examiner, you will play a crucial role in supporting incident response and performing insider threat investigations. You will leverage your expertise in digital forensics to uncover crucial facts about various incidents and leverage your expertise and skill to deliver other digital forensics services including support to eDiscovery, data recovery and other such tasks. The best candidates possess strong problem-solving skills, are proactive in their approach and are eager to apply all applicable digital forensic techniques and procedures to a variety of systems and environments.

Responsibilities

• Support to Incident Response & Insider Threat Investigations: Provide examination and analysis of electronically significant data in support of ongoing investigations
• Provide Corporate Forensics Services: Utilize specialized technical solutions to support of variety of corporate forensics needs (including eDiscovery, timeline analysis, and data recovery, etc.)
• Drive Service Enhancements: Develop playbooks and identify automation opportunities to ensure high integrity in evidence handling and limit process risk
• Conduct Cross-functional Collaboration: Work closely with external teams to support other internal investigations (ethics/policy, fraud, legal, etc.)
• Deliver Case Management & Reporting: Accountable for end-to-end case management for Digital Forensics contributions to cases, deliver detailed examination reports to stakeholders
• Improvement Through Independent Work: Demonstrate strong initiative, judgment, and problem-solving skills while working under limited supervision. Advocates for service enhancements, future capabilities
• Additional Analysis as Needed: Outside of Digital Forensics casework, lend knowledge, skills and abilities to other teams as needed; contribute to development of detection content, development of insider threat use cases, provide data analysis (audit/security logs) and support to threat hunt operations

Qualifications

• Bachelor's degree from an accredited institution in a related field
• Minimum of 5 years professional, specialized experience conducting digital forensics on a variety of media, including Windows, OS X, Linux
• Training and experience with EnCase forensic suite of tools, memory forensics tools and Endpoint Detection and Response (i.e. Defender)
• Knowledge and experience in Kusto Query Language
• One or more related certifications such as CFCE, EnCE, ACE, CDFE, CCE
• Training and experience in conducting host-based forensic examinations
• Training and experience in conducting log-based forensic examinations
• Experience in Splunk SIEM and SPL
• Training and experience supporting malware analysis
• Training and experience performing forensics in support of cloud-based incidents
• Training and experience performing volatile memory forensics
• Training and experience performing forensics on virtual machines Ability to establish and maintain effective relationships Possess a flexible, team-oriented approach to work
• Refined organizational and planning skills are essential
• Experience drafting and editing reports and documents
• Ability to troubleshoot, problem-solve, use sound judgement to generate and evaluate alternative solutions, and make recommendations to senior managers
• Excellent interpersonal skills and the ability to work with individuals at all levels within and outside the organization
• Possess the ability to deal tactfully, courteously, and professionally with customers and peers

Hours: Monday - Friday, 8:00AM - 4:30PM

Location: 820 Follin Lane, Vienna, VA 22180 | 5510 Heritage Oaks Drive, Pensacola, FL 32526 | 141 Security Drive Winchester, VA 22602

About Us