Security Spec Lead – Digital Forensics Analyst

• Conduct end-to-end investigations of internal and external matters
• Prepare findings reports for HR, Legal, Ethics, Physical Security, and other stakeholders
• Develop and maintain Digital Forensics policies and procedures documentation
• Support risk-reduction projects, including post-incident lessons learned
• Serve as a technical SME for Insider Threat, DLP, and cyber investigations
• Produce clear investigative and analytic reports for technical and executive audiences
• Maintain tools and technologies for Digital Forensics collection and analysis
• Partner with Cyber Incident Responders, HR, Legal, Ethics, Physical Security, and other stakeholders
• Manage cases from initiation to resolution
• Communicate technical conclusions in clear business language

• Ability to obtain and maintain a U.S. government security clearance
• In-depth understanding of Windows, Linux/Unix, MacOS, Android, iOS, and interconnected network devices
• Understanding of mobile device forensics and evidence collection techniques
• Experience with malware reverse engineering and analysis
• Understanding of anomalous user activity monitoring and policy violation investigations
• Ability to use internal and external log sources, forensic tools, and established investigative methods
• Ability to handle sensitive and confidential material appropriately
• Understanding of forensic capture and analysis methodologies and evidence chain of custody procedures
• Bachelor's degree OR Associate's degree with 2 years relevant experience OR High School Diploma/GED with 4 years relevant experience
• 7 or more years of Information Technology related experience OR 5 or more years of security related experience
• Experience with standard forensic methods and collection and analysis tools
• Experience conducting technical investigations or root cause analysis
• Experience identifying insider risk indicators through analytics tools
• Understanding and experience with digital forensics in a cloud environment
• Understanding of threat actor tactics, techniques, and procedures
• Familiarity with electric utility operations, IC/SCADA, or NERC CIP
• Working knowledge of programming languages and Splunk query development
• Ability to apply AI to threat detection and analysis
• Understanding and experience with security monitoring tools, SIEM platforms, and endpoint detection solutions
• Knowledge of cyber investigations and incident response processes
• Experience with case management and evidence handling procedures
• Experience with data classification, information protection, DLP, and sensitive data monitoring technologies
• Preferred certifications include SANS Forensics Certifications, CHFI, GCIH, and vendor-specific certifications

Demonstrates expertise in Digital Forensics, including evidence collection, analysis methodologies, and insider threat investigations. Proficient in communicating technical findings to diverse stakeholders and managing complex cases from initiation to resolution.

• Digital Forensics
• Malware Reverse Engineering
• Insider Threat Investigation
• Forensic Tools Proficiency
• Security Clearance

• Windows
• Linux/Unix
• MacOS
• Android
• IOS
• Mobile Device Forensics
• Anomalous User Activity Monitoring
• Data Classification
• Incident Response
• Root Cause Analysis

• Clear Communication
• Confidential Material Handling
• Stakeholder Collaboration

• SANS Forensics Certifications
• CHFI
• GCIH

• ICS/SCADA
• NERC CIP
• Cyber Investigations
• Threat Actor Tactics
• Evidence Chain of Custody

• Forensic Tools
• SIEM Platforms
• Endpoint Detection Solutions
• Splunk Query Development
• Cyber Investigation Tools