Network Forensics Analyst; IV) Information Technology Arlington, VA

Our Partner provides support for on-and-off-site incident response to government agencies and critical infrastructure owners who experience cyber-attacks. They deliver advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans. They are seeking a Network Forensics Analyst with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.

• Serveas a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises
• Serveas an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities
• Assist the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements
• Assistthe Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations
• Characterize and analyze network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources
• Identify and analyze anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity
• Reconstruct malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns
• Examine network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities
• Assess network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms
• Determine appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions
• Apply knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations
• Apply knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation
• Lead analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions
• Provide expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities
• Serveas a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents
• Exercise considerable latitude in determining technical objectives and independently develop technical solutions to complex problems requiring ingenuity and creativity
• Analyze incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening
• Advise technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists)
• Support internal stakeholders on containment and eradication missions, on-site and remotely
• Ensure evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs
• Assist with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies
• Distill analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences
• Document analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication
• Assistin maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities

• US Citizenship
• TS/SCI Clearance
• Ability to obtain DHS Suitability
• BS in Computer Science, Cyber Security, Computer Engineering, or related degree;…