Digital Forensics & Incident Response Analyst (DFIR) - TS Clearance

Washington, DC, USA | Salary | 100,000-130,000 per year | Full Time

COMPANY OVERVIEW

Founded in 2007 in Huntsville, AL, MartinFed provides the U.S. government with customer-focused, performance-based solutions using technology and an empowered workforce as an engine to drive its customers' missions. Our goal is to attract the best and brightest within their field.

We invest in our people because they are our greatest asset. They cultivate our purpose, embody and reflect our core values, and define our culture. MartinFed's core values that set us apart are the following:

• Be Driven - We are fueled by the hunger to learn more and do more.

• Be Curious - We engage in continuous improvement - never accepting the status quo.

• Be Humble - We seek honest feedback to strengthen our relationships.

• Pursue Excellence - We strive to achieve extraordinary results and do not settle for mediocrity.

Strive for excellence and consider joining our growing team today!

JOB OVERVIEW

The Digital Forensics & Incident Analyst supports the Threat Analysis & Investigations (TA&I) function, analyzing digital evidence and investigating computer security incidents to derive information that supports system and network vulnerability mitigation. The analyst provides Tier 2 and Tier 3 support to the enterprise Security Operations Center (SOC) and coordinates with partner/enterprise security operations centers as required for incident response and advanced analysis. Aligned to the NICE Framework, the role identifies, collects, examines, and preserves digital evidence using controlled and documented analytical and investigative techniques in support of authorized requesting authorities - including oversight bodies, legal and general counsel offices, professional-responsibility offices, FOIA requests, and law enforcement partners. The analyst conducts digital analysis in response to investigations of computer-based crimes and cyber-intrusion incidents, leveraging enterprise forensic and live-monitoring tools while rigorously maintaining chain of custody. Incoming requests are logged into a case management application, and the analyst performs the analytical function supporting the appropriate authorities.

ESSENTIAL FUNCTIONS

• Analyze log files, evidence, and other information to determine the best methods for identifying the perpetrator(s) of a network intrusion.

• Confirm what is known about an intrusion and discover new information via dynamic analysis.

• Provide technical summaries of findings in accordance with established reporting procedures and deliver written analysis reports to requesting customers.

• Examine recovered data for information relevant to the matter at hand.

• Perform file signature analysis and file system forensic analysis across implementations such as NTFS, FAT, and EXT.

• Collect and analyze intrusion artifacts (e.g., source code, malware, system configuration) and use discovered data to enable mitigation of potential cyber defense incidents.

• Conduct malware analysis in the event of a compromise, identify obfuscation techniques, and interpret debugging results to ascertain adversary tactics, techniques, and procedures.

• Determine the extent of threats and recommend courses of action or countermeasures to mitigate risk; analyze crises to ensure public, personal, and resource protection.

• Identify data concealment methods (e.g., encryption algorithms, steganography) and conduct memory dumps to extract information.

• Conduct security event analysis and correlation using enterprise tooling, and apply network security architecture concepts (topology, protocols, components, defense-in-depth) to forensic analysis.

• Determine physical computer components and architectures, conduct physical disassembly of systems, and identify/modify/manipulate system components within Windows, Unix, or Linux (e.g., passwords, user accounts, files).

• Apply system administration, network, and operating-system hardening techniques, and use virtual machines (e.g., Hyper-V, VMware vSphere, Citrix Xen, Amazon EC2) during analysis.

• Conduct hashing for chain-of-custody and validation (e.g., SHA, MD5) and preserve evidence integrity according to standard operating procedures or national standards.

• Support the full evidence lifecycle - collecting, packaging, transporting, and storing electronic evidence while maintaining chain of custody - and interpret insider-threat investigations, reporting, tools, and applicable laws/regulations.

• Provide legal governance related to admissibility (e.g., Rules of Evidence) and advise on applicable laws and statutes (e.g., Titles 10, 18, 32, and 50, U.S. Code), Presidential Directives, and executive/administrative/criminal guidelines.

• Provide risk-management recommendations and apply knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.

• Support forensic application updates and replacements as technology changes; develop workflow diagrams and requirements for continued case management application growth; and support contingency and recovery planning for enterprise forensic and case management applications.

• Support solution evaluation and pilot initiatives by identifying essential technology components, reviewing and updating the System Design Document, and assisting the ISSO with assessment and authorization (A&A) activities to establish Authority to Test. Coordinate limited-user pilots, then present findings and recommendations to the TA&I Program Manager and staff for review.

QUALIFICATIONS

• U.S. citizenship and an active Top Secret (TS) security clearance.

• Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Systems, or a related field.

• 7+ years of hands-on digital forensics and incident response (DFIR) experience, ideally in federal or otherwise regulated environments.

• Digital forensics certification such as CFIA or CFIH.

• Demonstrated expertise with industry-standard forensic and analysis tools (e.g., EnCase, FTK, Autopsy/The Sleuth Kit, X-Ways, Volatility, Wireshark, YARA, and malware reverse-engineering tools such as Ghidra or IDA Pro).

• Strong command of Windows, Unix, and Linux internals; file systems (NTFS, FAT, EXT); virtualization; and SIEM/event-correlation platforms.

• Working knowledge of the NICE Framework, NIST guidance, MITRE ATT&CK, chain-of-custody standards, and Rules of Evidence.

• Excellent technical writing and the ability to present findings clearly to legal, oversight, and investigative authorities.

• PHYSICAL REQUIREMENTS & ENVIRONMENTAL CONDITIONS

• Inside office environment.

• Working on a computer for long periods of time.

• May involve long period of sitting at a desk.

• The work environment is fast-paced and sometimes involves extreme deadline pressures.

OTHER DUTIES

This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.

MartinFed is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, religious creed, gender, sexual orientation, gender identity, gender expression, transgender, pregnancy, marital status, national origin, ancestry, citizenship status, age, disability, protected Veteran Status, genetics or any other characteristics protected by applicable federal, state or local law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. In addition to federal law requirements, MartinFed complies with all applicable state and local laws governing nondiscrimination in all locations.

If you are a qualified individual with a disability or disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access MartinFed's current openings as a result of your disability. You can request reasonable accommodations by calling 855.212.1810. Thank you for your interest in MartinFed.

Please Note: All positions at MartinFed are contingent upon passing a background check prior to a start date and are subject to random drug screenings during the employment period. In addition, MartinFed is an E-Verify employer.