Senior Forensic Analyst

Revolutional delivers advanced technology solutions and mission support to federal agencies across civilian, health, and national security environments. We apply modern capabilities, including AI/ML, cloud, cybersecurity, and IT modernization to solve complex challenges, enable faster and more secure operations, and drive measurable mission outcomes.

We are redefining how federal technology gets built and delivered by operating with a product mindset, prioritizing speed, ownership, and execution over bureaucracy.

Senior Forensic Analyst

Location: Washington, DC, Ft. Collins, CO, or Kansas City, MO (remote optional, local preferred)

Terms: Full-time

Clearance: Active Top Secret required

Salary Range: $130-170k DOE

Travel: Yes – travel to government sites as required

This position supports a large-scale federal security operations program responsible for protecting enterprise networks, detecting and responding to intrusions, and conducting forensic investigations of suspected compromises. Forensic evaluations on this program are non-repetitive, fixed-duration engagements — each one is unique, consequential, and conducted under legal chain of custody requirements.

The core challenge: conducting rigorous forensic evaluations of federal systems suspected of compromise — independently, under legal and evidentiary standards, with findings that inform both immediate response and broader intelligence community awareness.

As a Senior Forensic Analyst at Revolutional, you conduct forensic evaluations of federal enterprise systems suspected of compromise. You are a senior practitioner operating with a high degree of independence — each engagement is distinct, and you bring the expertise to scope, execute, and deliver findings without a playbook written specifically for the situation in front of you.

You maintain strict chain of custody in accordance with applicable federal and state legal requirements, conduct both host and network analysis to determine the full extent of compromise, and interface directly with the intelligence community to share and receive context that sharpens your findings. You may travel to government sites as required to support on-site forensic collection and analysis.

• End-to-end forensic evaluation of federal systems suspected of compromise
• Chain of custody integrity across all evidence collected and handled
• Host and network analysis to determine compromise scope and attacker activity
• Intelligence community interface and information sharing on active investigations
• Forensic project support across program-directed engagements
• On-site forensic collection and analysis at government facilities as required

• Conduct forensic evaluations of federal enterprise systems, endpoints, and media suspected of compromise; apply rigorous methodology and maintain chain of custody throughout in accordance with applicable federal and state law
• Perform host-based forensic analysis: disk imaging, file system examination, artifact recovery, memory analysis, and timeline reconstruction to determine attacker activity and compromise extent
• Conduct network forensic analysis: packet capture review, Net Flow analysis, log correlation, and lateral movement identification to establish the full scope of intrusion activity
• Produce thorough, legally defensible forensic reports documenting findings, methodology, evidence handling, and recommended response actions
• Interface with the intelligence community to share forensic findings, receive relevant threat context, and ensure investigations are informed by the current intelligence picture
• Support forensic projects as directed by program leadership, including surge support for high-priority or time-sensitive investigations
• Travel to government sites as required to conduct on-site evidence collection, system imaging, and forensic analysis
• Maintain current awareness of adversary TTPs, malware families, and forensic evasion techniques relevant to the federal threat landscape
• Contribute to development and refinement of forensic procedures, evidence handling standards, and investigation methodologies
• Coordinate with…