Digital Forensics and Incident Response; DFIR Analyst; Principal Cyber Security Analyst

Overview

Mission Support and Test Services, LLC (MSTS) manages and operates the Nevada National Security Site (NNSS) for the U.S. National Nuclear Security Administration (NNSA). Our MISSION is to help ensure the security of the United States and its allies by providing high-hazard experimentation and incident response capabilities through operations, engineering, education, field, and integration services and by acting as environmental stewards to the Site's Cold War legacy.

Our VISION is to be the user site of choice for large-scale, high-hazard, national security experimentation, with premier facilities and capabilities below ground, on the ground, and in the air. Our 2,750+ professional, craft, and support employees are called upon to innovate, collaborate, and deliver on some of the more difficult nuclear security challenges facing the world today.

• As a DFIR Analyst at NNSS, you will be on the front lines, safeguarding against cyber threats to support vital programs like nuclear stockpile stewardship and counter terrorism. Your expertise in incident response and digital forensics will directly contribute to our mission of delivering technical solutions for the U.S. government s national security objectives.
• Monitor intrusion detection/prevention systems (IDS/IPS), Security Event and Incident Management (SEIM) tools, endpoint security tools, email gateways, firewalls, network infrastructure, and other appliances for security issues.
• Create logical and physical forensic images of digital evidence via the network or directly from hosts.
• Analyze host-based indicators of compromise or network traffic and analyze additional log, forensic, malware, or other incident response related data, as needed.
• Participate as part of an incident response team to detect, respond to, contain, and remediate cyber-related threats against IT assets.
• Seize digital evidence in support of investigations and conduct host-based and network-based forensic analysis of digital evidence.
• Create detailed reports of investigative activity for consumption by internal and external organizations including Human Resources, Legal Department, Information Security Officers, and local, state, and federal law enforcement.
• Conduct digital investigations involving breaches of IT infrastructure, forensic investigations, legal and privacy issues requiring digital investigations, and network forensic investigations handling large-scale, complex post-incident investigations where techniques such as network forensics, malware reverse engineering, log analysis, timeline creation, and host-based forensics have been applied.
• Understand high-tech investigation skills, techniques, and tools necessary for conducting live forensics on critical systems and producing detailed analysis of root causes.
• Provide root cause analysis, impact assessments, and rapid response to aid detection of those responsible and prevent recurrence.
• Conduct reverse engineering of malware and report findings; focus on projects of substantial complexity and broad scope requiring interdisciplinary coordination.
• Independently perform host-based forensic investigations to establish user activity on systems.
• Plan, schedule, and direct projects guided by established objectives, budgets, and schedules.
• Assist in researching, compiling, and analyzing technical data; multitask between responsibilities as required.
• Review Cyber Security threat information and assist with mitigating identified vulnerabilities.
• Develop standards, practices, and procedures and increase technical knowledge to solve problems and complete projects.
• Maintain cooperative and respectful working relationships with Cyber Security staff, other divisions, and customers; contribute to a productive work environment.

• Bachelor's degree or equivalent training and experience in a computer-related field and at least 8 years of related experience.
• Understanding of advanced principles, theories, standards, practices, protocols, and procedures used in Digital Forensics and Incident Response.
• Knowledge of Windows operating systems, command line tools, network protocols, and TCP/IP fundamentals;…