Digital Forensics Analyst

Qualifications

• Minimum of 8 years with BS/BA;
  Minimum of 6 years with MS/MA;
  Minimum of 3 years with PhD
• Clearance:
  Active TS/SCI clearance.
• Candidate must meet ONE of the following:
  • Master’s degree or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, Software Engineering, or a related field; OR
  • Relevant DoD/military training (if applicable); OR
  • Relevant professional certification or equivalent experience (examples: GREM, CFR, CySA+, GCFA, GCFE, Pen Test+).
• Required experience and skills:
  • Digital forensics, incident response, or cyber investigations experience with at least 3 years performing advanced forensic analysis in enterprise or DoD environments.
  • Demonstrated expertise in disk/memory forensics, network traffic analysis, cloud artifact collection, and use of forensic toolsets (e.g., EnCase, FTK, X‑WAYS, Volatility, Rekall, Cellebrite, cloud forensics tools).
  • Strong knowledge of evidence handling, chain‑of‑custody, legal/privilege considerations, and producing courtroom‑quality forensic reports.
  • Ability to map forensic findings to MITRE ATT&CK, threat intelligence, and operational impact; provide actionable recommendations to responders and leadership.
  • Experience coordinating cross‑organizational investigations and supporting law enforcement or counterintelligence handoffs.
• Desired:
  • Completion of advanced forensic training such as DC3 Cyber Forensics Course or equivalent DoD/IC forensic courses.
  • Prior experience supporting DoD/ARNG investigations, legal proceedings, or multi‑agency forensic operations.
  • Familiarity with forensic automation, validated lab environments, and scalable forensic triage for high‑volume environments.

We are seeking a highly skilled and innovative Digital Forensics Analyst to join our team in the greater DMV area, supporting the Army National Guard.

• Lead advanced digital forensic investigations across endpoints, networks, and cloud environments: acquire, preserve, and analyze artifacts to reconstruct timelines and determine scope and impact.
• Perform forensic acquisition using industry‑standard tools and techniques; maintain chain‑of‑custody and evidence integrity for legal and investigative use.
• Correlate forensic artifacts with threat intelligence and MITRE ATT&CK mappings to identify adversary TTPs, indicators of compromise, and attribution signals.
• Conduct memory, disk, log, and cloud artifact analysis; extract, preserve, and document volatile and non‑volatile data for investigative and prosecutorial requirements.
• Produce detailed, defensible forensic reports, timelines, and expert‑level briefings for incident response, legal, counterintelligence, and senior leadership audiences.
• Support incident containment and remediation by providing forensic findings, recommended mitigations, and validation of remediation actions.
• Develop and maintain forensic playbooks, procedures, and tooling; mentor forensic staff and ensure QA of forensic products.
• Coordinate with SOC, CIRT, threat intel, and law‑enforcement partners during investigations and evidence handoffs.
• Maintain readiness through tooling validation, lab exercises, and continuous improvement of forensic methodologies.