cyber defense forensics analyst

Booz Allen Hamilton

<div>Cyber Defense Forensics Analyst
The Opportunity:
As a security operations center analyst, you&rsquo;re in the middle of the action, responding to and mitigating threats in real time. You&rsquo;re the first line of cyber defense for your organization, and they look to you for guidance on best practices and security measures. We need a SOC analyst like you to help us secure critical infrastructure from the constant onslaught of cyber-attacks.
As an analyst on our team, you&rsquo;ll develop network defense skills as you learn to monitor, detect, and analyze threats by interacting directly with affected users and leveraging state-of-the-art technologies.
When an incident is detected, you&rsquo;ll work with the team to collect data to help incident response understand and mitigate the threat. You&rsquo;ll analyze alerts to figure out just how many systems are affected and initiate recovery efforts. You&rsquo;ll contribute to assessments and learn how to analyze patterns to understand attackers&rsquo; goals to stop them from succeeding. This is a great opportunity to hone your cybersecurity skills and learn more about threat assessment and incident response.
Work with us as we secure against malicious actors.
Join us. The world can&rsquo;t wait.
You Have:<ul><li>
Experience conducting digital forensics or incident response investigations within classified DoD environments</li><li>
Experience with forensic tools such as EnCase, FTK, Autopsy, Cellebrite, Volatility, or X-Ways</li><li>
Experience with SIEMS such as Splunk or ArcSight</li><li>
Knowledge of Windows, Linux, and network forensic artifacts, including memory and disk analysis</li><li>
Ability to identify, triage, and report events that occur to protect data, information systems, and infrastructure</li><li>
Ability to collect, preserve, and analyze evidence in accordance with DoD or federal chain-of-custody standards</li><li>
Ability to find trends, patterns, or correlations in security data</li><li>
TS/SCI clearance</li><li>
Bachelor&rsquo;s degree in a CS, Cybersecurity, or Digital Forensics field</li><li>
DoD 8140 baseline Level II Certification such as Security+, CySA+, CISSP, or DoD Cyber Workforce Framework Certification</li></ul>
Nice If You Have:
<ul><li>Experience supporting Cyber Protection Teams (CPTs), Defensive Cyber Operations (DCO), or Air Force cyber missions</li><li>
Experience with Elastic, Splunk, Wireshark, or MISP for multi-source data correlation</li><li>
Knowledge of malware analysis, reverse engineering, or memory forensics</li><li>
Ability to prepare and brief forensic findings to commanders or senior decision-makers</li><li>
Master&rsquo;s degree in Digital Forensics, Information Assurance, or Cybersecurity</li><li>
GCFA, GCFE, CHFI, or CEH Certifications</li></ul>
Clearance:
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; TS/SCI clearance is required.
Compensation
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $55,300.00 to $126,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.
Identity Statement
As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.
Work Model 
Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.<ul><li>
If this position is listed as remote or hybrid, you&rsquo;ll periodically work from a Booz Allen or client site facility.</li><li>
If this position is listed as onsite, you&rsquo;ll work with colleagues and clients in person, as needed for the specific role.</li></ul>
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</div>

Cyber Defense Forensics Analyst

PwC Middle East

<div>
 
 Line of Service
 
 
 
 Advisory
 
 
 
 Industry/Sector
 
 
 
 Technology
 
 
 
 Specialism
 
 
 
 Advisory - Other
 
 
 
 Management Level
 
 
 
 Associate
 
 
 
 Job Description &amp; Summary
 
 
 
 
 About PwC ETIC - Egypt Technology and Innovation Centre
 
 
 
 PwC is opening a new Technology &amp; Innovation Center in Cairo that will deliver high quality technology solutions to consulting Clients across the globe. The Centre will provide a broad suite of skills and services to our clients, ranging from Packaged Applications such as SAP &amp; Oracle, to cyber security, data analytics, custom development and cloud services utilising AWS, Azure and Google, as well as expanding our existing managed services capabilities.
 
 
 The centre is looking to expand rapidly and we are looking for enthusiastic self-starters with a passion for technology and client delivery to help shape and form this new venture.
 
 
 
 
 Forensic Technology
 
 
 
 
 Our Forensic Technology team helps clients manage vast amounts of electronic data and helps to locate the key emails, mobile phone evidence and electronic documents needed to investigate complex, fast-paced issues often in the public eye.
 
 
 Prevention is even better; knowing where vulnerabilities are and managing the risks involved. When disputes or regulatory investigations arise, a timely resolution relies on organisations being prepared. And this is what we help our clients with every day.
 
 
 
 
 eDiscovery
 
 
 
 
 Searching the personal computer and smartphone of an executive suspected of intellectual property theft, or identifying emails containing evidence of price fixing are the kinds of challenges we tackle every day as part of the team within one of the largest dedicated forensic technology practices in the world. In simple terms, we specialise in providing the technology skills required to respond to crisis events such as legal disputes or regulatory investigations.
 
 
 
 Example Of Responsibilities
 
 
 
 <ul>
 <li>
 Conduct research to develop new techniques and methodologies which support our Digital Forensic capabilities. This includes staying up-to-date with the latest trends and challengers in the field, and working to develop solutions to address them. This focuses on Mobile / Computer forensics and cloud based platforms, our main toolsets are Cellebrite, XRY, Magnet Forensics Axiom and Opentext EnCase Forensic.
 </li>
 <li>
 Improving the use of our existing Digital Forensic Tools. This involves thinking about how we can improve our use of the existing off-the-shelf that we licence. This might include software development of addons/plugins, testing new features and contributing to our strategy around addressing specific issues - for example improving how we extract and report mobile chat data.
 </li>
 <li>
 Automation and AI. Focus on how we can automate our Digital Forensic processes using AI and other technologies to enhance our offering to clients and make delivery of Digital Forensic engagements more efficient and commercially successful.
 </li>
 <li>
 Training. Help create comprehensive training material on new tools and methodologies, and deliver via the appropriate channel. Work with territory L&amp;D teams to provide a good learning experience for junior and senior team members.
 </li>
 <li>
 Collaboration. Work collaboratively with the PwC Digital Forensics, eDiscovery and Cyber communities to understand their challenges and needs. Create and maintain relationships with the wider digital forensics community including third party vendors to evaluate and test product offerings which may be beneficial to our clients. Work with procurement, tech risk and OGC to onboard new third party vendors.
 </li>
 <li>
 Quality Assurance and Compliance. Researching and distilling the requirements of legal and industry regulation which impact our Digital Forensic work in the UK. This includes ISO 27000 Series international standards and the Forensic Science Regulator&rsquo;s code of practice. Provide support to teams on developing and maintaining processes which implement the requirements of these regulations.
 </li>
 <li>
 Knowledge Sharing. Be aware of the latest industry developments from relevant conferences and workshops relating to Digital Forensics which may be relevant to our Digital Forensic engagements. Contribute to PwC published blogs and other knowledge sharing/marketing material.
 
 
 </li>
 </ul>
 
 Skills
 
 
 
 <ul>
 <li>
 Experience with mainstream digital forensic tools from Cellebrite, Magnet Forensics, MSAB, OpenText and others. Required.
 </li>
 <li>
 Has previous experience in performing digital forensic investigations as a practitioner working in a commercial or law enforcement setting. Required.
 </li>
 <li>
 Has previous experience in deployment and management of cloud platforms, including (some of) Azure, AWS, GCP, Microsoft 365 and Google Workspace. Required.
 </li>
 <li>
 Has or is able to build relationships with stakeholders and third party vendors. Required.
 </li>
 <li>
 Experience of creating technical documentation and written processes appropriate to both a technical (e.g. Other Technologists) and non-technical audience (e.g. Leadership). Required
 </li>
 <li>
 Software development and testing experience Desirable
 </li>
 <li>
 Experience of creating and/or delivering technical training. Desirable
 </li>
 <li>
 Experience of working in, and supporting the maintenance of, an ISO-accredited environment (either ISO17025 or ISO17020). Desirable.
 </li>
 <li>
 Experience of Relativity (Relativity One, Server, Collect, Legal Hold, Translate, Redact, Contracts) or similar Required
 </li>
 <li>
 Experience of Intelligent Voice or similar Desirable
 </li>
 <li>
 Experience of Brainspace or similar Desirable
 
 
 </li>
 </ul>
 
 Education
 
 
 (if blank, degree and/or field of study not specified)
 
 
 
 
 Degrees/Field Of Study Required
 
 
 
 Degrees/Field of Study preferred:
 
 
 
 Certifications
 
 
 (if blank, certifications not specified)
 
 
 
 
 Required Skills
 
 
 
 
 Optional Skills
 
 
 
 
 Desired Languages
 
 
 (If blank, desired languages not specified)
 
 
 
 
 Travel Requirements
 
 
 
 Not Specified
 
 
 
 Available for Work Visa Sponsorship?
 
 
 
 No
 
 
 
 Government Clearance Required?
 
 
 
 No
 
 
 
 Job Posting End Date
 
</div>

ETIC, eDiscovery and Digital Forensics Associate

DTS Solution

Role and Responsibilities 
 
 <div>
 <div>
 <ul>
 <li>
 
 Work as a DFIR consultant in DTS Solution supporting our 800-HACKED program </li>
 <li>
 
 Work as a consultant for many Incident Retainer Program </li>
 <li>
 
 Cyber breach investigations including forensic and malware analysis. Identifies network computer intrusion evidence and perpetrators. </li>
 <li>
 
 Strong understanding on threat hunting methodologies. </li>
 <li>
 
 Strong experience in post-compromise assessment. </li>
 <li>
 
 Ability to perform detailed forensics investigations; </li>
 <li>
 
 Knowledge on DFIR tools Autospy, Encase, Access Data, FTK+, IDA etc. </li>
 <li>
 
 Examines and performs comprehensive technical analysis of computer-related evidence and information stored on a device(s) during the conduct of an investigation or litigation. </li>
 <li>
 
 Proactively advise teams/hunt for and research potential malicious activity and incidents across multiple platforms using advanced threat network and host-based tools. </li>
 <li>
 
 Use both internal and external threat intelligence to build indicators of compromise into monitoring tools, can integrate these tools with one another to provide data enrichment. </li>
 <li>
 
 Use strong TCP/IP networking skills to perform network analysis to isolate and diagnose potential threats and anomalous network behavior. </li>
 <li>
 
 Ensures chain of custody and control procedures, documents procedures and findings in a manner suitable for courtroom presentation and prepares comprehensive written notes and reports. </li>
 <li>
 
 Report common and repeated problems (trend analysis) to management and propose process and technical improvements. </li>
 <li>
 
 Provide resolution plans for system and network issues. </li>
 <li>
 
 Provide support in the detection, response, mitigation, and reporting of real or potential cyber threats to the environment and assist in the automation of the processes. </li>
 <li>
 
 Provides oral and written communication to staff personnel concerning findings of fact, results of examination(s), and legal declarations, and testify in court as to the procedures and methodology used to recover and identify relevant evidence. </li>
 <li>
 
 Ability to write Incident Response Reports in accordance to international standards. </li>
 </ul>
 </div>
 </div>
 <div>
 <div>
 <div>
</div>
 </div>
 </div>
 <div>
 <div>
 Qualifications </div>
 </div>
 <div>
 <div>
 <ul>
 <li>
 
 6+ years of experience of network/security and analyzing digital evidence and investigate computer security incidents </li>
 <li>
 
 Expert knowledge on DFIR tools such as Access Data, IDA Pro, FTK+, Encase </li>
 <li>
 
 Expert knowledge on threat hunting tools commercial and open source </li>
 <li>
 
 Familiarity with network tools such as Wireshark, tcpdump, libpcap. </li>
 </ul>
 </div>
 </div>
 <div>
 <div>
 <div>
</div>
 </div>
 </div>
 <div>
 <div>
 Certifications </div>
 </div>
 <div>
 <div>
 <ul>
 <li>
 
 GCIA, GCIH, or CISSP Certifications </li>
 <li>
 
 SANS Certified Forensic Examiner (GCFE) </li>
 <li>
 
 Forensic/ Incident Response Professional </li>
 <li>
 
 Industry Certification on Digital Forensics Tool </li>
 </ul>
 </div>
 </div>
 
 
 <div>
 <div>
<div>
 <div>
 <div>
 <div>
 <div> </div></div><div>
 </div>
 <div>
 <div>
 <div></div></div></div></div></div></div></div></div>

Digital Forensics and Incident Response Consultant

RealmOne

<div>RealmOne was built on the principle that people matter first and foremost. We believe in providing a strong work/life balance by investing in our employees and encouraging professional and personal growth. We do this by offering exceptional benefits, flexible schedules, and the tools necessary to achieve success through paid training, mentoring, and the opportunity to work alongside top-notch industry professionals.

Join us on this journey as we execute this mission-critical contract providing Cybersecurity Expertise and Risk Management Services!

Your effort and expertise are crucial to the success and execution of this impactful mission that is critical in ensuring mission success through Security Engineering, Risk Management and Assessment, and Insider Threat Analysis, by improving, protecting, and defending our Nation&rsquo;s Security.

Job Description:
<ul>
<li>Uses information collected from a variety of sources to monitor network activity and analyze it for evidence of anomalous behavior. Identifies, triages, and reports events that occur in order to protect data, information systems, and infrastructure. Finds trends, patterns, or anomaly correlations utilizing security-relevant data. Recommends proactive security measures. Conducts analysis to isolate indicators of compromise. Notify designated managers, cyber incident responders, and cybersecurity service provider team member of suspected cyber incidents and articulate the event&rsquo;s history, status, and potential impact for further action in accordance with the organization&rsquo;s cyber incident response plan.</li>
</ul>
The Cyber Defense Analyst 2 shall possess the following capabilities:
<ul>
<li>Use cyber defense tools to monitor, detect, analyze, categorize, and perform initial triage of anomalous activity.</li>
<li>Generate cybersecurity cases (including event&rsquo;s history, status, and potential impact for further action) and route as appropriate.</li>
<li>Leverage knowledge of commonly used network protocols and detection methods to defend against related abuses.</li>
<li>Apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).</li>
<li>Perform advanced manual analysis to hunt previously unidentified threats.</li>
<li>Conduct PCAP analysis.</li>
<li>Identify cyber-attack phases based on knowledge of common attack vectors and network layers, models and protocols.</li>
<li>Apply techniques for detecting host- and network-based intrusions.</li>
<li>Working knowledge of enterprise-level network intrusion detection/prevention systems and firewall capabilities.</li>
<li>Understand the foundations of a hardened windows network and what native services and protocols are subject to abuse.</li>
<li>Familiarity with fragmentation of network traffic and how to detect and evaluate fragmentation related attacks in raw packet captures.</li>
<li>Conduct network &ndash; traffic, protocol and packet-level &ndash; and netflow analysis for anomalous values that may be security-relevant using appropriate tools.</li>
<li>Understand snort filters and how they are crafted and tuned to feed IDS alerting.</li>
<li>Understand system and application security threats and vulnerabilities to include buffer overflow, SQL injection, race conditions, covert channel, replay and return-oriented attacks, malicious code and malicious scripting.</li>
<li>Analyze malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.</li>
<li>Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.</li>
<li>
Familiar with indications of Command and Control (C2) channels and what strategies attackers use to bypass enterprise defenses from a compromised host. 
<div></div>
</li>
</ul>Qualifications:
<ul>
<li>Four (4) years of demonstrated experience as CDA in programs and contracts of similar scope, type, and complexity required. A technical bachelor&rsquo;s degree from an accredited college or university may be substituted for two (2) years of CDA experience on projects of similar scope, type, and complexity.</li>
<li>One (1) year of demonstrated and practical experience in TCP/IP fundamentals.</li>
<li>One (1) year of demonstrated experience with tcpdump or Wireshark.</li>
<li>Two (2) years of demonstrated experience using security information and event management suites (such as Splunk, ArcSight, Kibana, LogRhythm).</li>
<li>Two (2) years of demonstrated experience in network analysis and threat analysis software utilization.</li>
<li>Two (2) years of demonstrated experience maintaining or managing Cloud environments such as Microsoft Azure, Amazon Web Services (AWS), using tools like Microsoft Sentinel.</li>
</ul>
Certifications Required:
<ul>
<li>Requires DoD 8570 compliance with CSSP Analyst baseline certification.</li>
<li>Requires Information Assurance Technical (IAT) Level I or Level II certification.</li>
<li>Requires Computing Environment (CE) certification.</li>
<li>Requires successful completion of the Splunk software training course &ldquo;Fundamentals 1&rdquo;.</li>
</ul>
Position requires active Security Clearance with appropriate Polygraph
Pay Range: 176,000-227,000
<div>The RealmOne pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Our approach to crafting offers considers various factors to establish an equitable and competitive compensation package. These considerations include, but are not limited to, the extent and intricacy of the role&rsquo;s responsibilities, the candidate&rsquo;s educational background, their work experience, and the specific competencies crucial for success in the role.

RealmOne Benefits:
<ul>
<li>Healthcare Coverage + Insurance: Medical: Three (3) rich healthcare options through CareFirst with 100% or majority company-paid premiums. Tax-advantaged health savings account available with generous employer contribution. Dental + Vision: 100% employer-paid for employees and family, with a buy-up option available.</li>
<li>Retirement + Savings: 401K &ndash; 10% TOTAL CONTRIBUTION &ndash; 5% safe harbor &ndash; 5% annual profit share (both immediately vested!).</li>
<li>Paid Time Off + More: 4 weeks starting PTO &ndash; 11 federal holidays + 2 floating holidays &ndash; Paid hours for company-required training.</li>
<li>Career Growth + Development: Access to FREE 24/7 learning via Udemy &ndash; Opportunities to participate in tech councils, industry initiatives, etc. &ndash; $7,500 annual Educational &amp; Professional Development Assistance.</li>
<li>MORE BENEFITS&hellip;FOR EVERY LIFESTYLE! &ndash; Paid parental leave &ndash; Adoption assistance &ndash; Annual swag drops &ndash; Flexible work schedules -Generous referral bonus program &ndash; Employee appreciation + family-friendly corporate events &hellip;and much more.</li>
</ul>
ABOUT US
<ul>
<li>RealmOne is a mid-sized science and technology company dedicated to solving our customers&rsquo; toughest mission challenges.</li>
<li>Headquartered in Columbia, MD., RealmOne supplies advanced cybersecurity, data science, and software engineering services and products to customers in the Government and commercial sectors.</li>
<li>RealmOne delivers encompassing mission assurance and critical systems support to government customers across various U.S. locations to include Colorado, Georgia, Hawaii, Texas, Utah, and Virginia.</li>
<li>RealmOne has won numerous awards, including Top Workplaces by the Baltimore Sun. Across more than 20 prime contracts, RealmOne is a premier innovator for the Government and Department of Defense, and our team is located across the United States.</li></ul></div></div><div></div>

Cyber Defense Analyst 2 (CDA2)

<div>Malware Analyst
The Opportunity:
As a security operations center analyst, you&rsquo;re in the middle of the action, responding to and mitigating threats in real time. You&rsquo;re the first line of cyber defense for your organization, and they look to you for guidance on best practices and security measures. We need a SOC analyst like you to help us secure critical infrastructure from the constant onslaught of cyber attacks.
As an SOC analyst on our team, you&rsquo;ll develop network defense skills as you learn to monitor, detect, and analyze threats by interacting directly with affected users and state-of-the-art tools and technologies.
When an incident is detected, you&rsquo;ll work with the team to collect data to help incident response understand and mitigate the threat. You&rsquo;ll analyze alerts to figure out just how many systems are affected and initiate recovery efforts. You&rsquo;ll contribute to assessments and learn how to analyze patterns to understand attackers&rsquo; goals to stop them from succeeding. This is a great opportunity to hone your cybersecurity skills and learn more about threat assessment and incident response.
Work with us as we defend against malicious actors.
Join us. The world can&rsquo;t wait.
You Have:<ul><li>
4+ years of experience in a SOC, incident response, or cyber threat analysis role</li><li>
Experience in analyzing logs, network traffic, digital forensics, malware analysis, threat intelligence, and cybersecurity</li><li>
Experience with incident response frameworks, such as NIST or MITRE ATT&amp;CK</li><li>
Knowledge of SIEM, such as Splunk, Elastic, QRadar, or Sentinel, EDR, such as CrowdStrike or Microsoft Defender, IDS, and IPS</li><li>
Knowledge of operating system-specific exploitation vectors</li><li>
TS/SCI clearance</li><li>
Bachelor&rsquo;s degree in Cybersecurity or Information Technology and 5+ years of experience in Cybersecurity, or 10+ years of experience in Cybersecurity in lieu of a degree</li><li>
DoD 8140 Level II Certification, such as Security+, CySA+, or CISSP</li><li>
GCIH, GCIA, CEH, or CISSP Certification</li></ul>
Nice If You Have:<ul><li>
Experience supporting Air Force or DoD Cyber Protection Teams (CPTs) or cyber threat intelligence missions
</li><li>Experience in malware classification, unpacking, and behavioral analysis</li><li>
Experience developing custom scripts and automation in Python or PowerShell for analysis workflows</li><li>
Knowledge of adversary TTPs and frameworks such as MITRE ATT&amp;CK and CAPEC</li><li>
Knowledge of cyber kill chain methodologies</li><li>
Master&rsquo;s degree in Cybersecurity, Computer Engineering, or Digital Forensics</li><li>
GREM, GCFA, or OSCP Certification</li></ul>
Clearance:
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; TS/SCI clearance is required.
Compensation
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $55,300.00 to $126,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.
Identity Statement
As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.
Work Model 
Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.<ul><li>
If this position is listed as remote or hybrid, you&rsquo;ll periodically work from a Booz Allen or client site facility.</li><li>
If this position is listed as onsite, you&rsquo;ll work with colleagues and clients in person, as needed for the specific role.</li></ul>
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</div>

Malware Analyst

Naufar

<div>
 
 
 JOB PURPOSE:
 
 
 
 The Cyber Security Analyst creates a comprehensive program for establishing a Healthcare carrier-class Security Operation Center. S/he develop and maintain threat monitoring and security incident response procedures within Naufar. The analyst designs frameworks, procedures, and toolkits to enhance capabilities in professional forensic collection and digital evidence analysis. S/he also develop dashboards for reporting the organization's threat landscape, Awareness and security posture to senior management. This role is expert role with roles and responsibilities.
 
 
 
 
 
 
 Description
 
 
 <ul>
 <li>
 Develops and implements a cyber-security program to enhance Naufar capabilities regarding Cyber Attack incident monitoring, incidents response and intrusive and non-intrusive forensics capabilities.
 </li>
 <li>
 Develops and matures the service capabilities of the SOC, such as Forensics, Threat Management, Penetration Assessments, and Tool Management.
 </li>
 <li>
 Develops, Contributes and maintains of the cyber security strategy.
 </li>
 <li>
 Implements, configures and maintains security control and process, to ensure threat indicators are rated by severity and responded to in a manner consistent with the threat.
 </li>
 <li>
 Identifies deficiencies and recommends corrective action to strengthen information security control and decrease the risk of data breach.
 </li>
 <li>
 Maintains and updates standard operation policies and procedures for incident response plans, e-discovery processing, remote acquisition/analysis tools, collections and forensic analysis techniques.
 </li>
 <li>
 Maintains industry standard tools and processes used for forensic analysis and eDiscovery collections and processes.
 </li>
 <li>
 Monitors security alerts for potential events/incidents as well as trending and historical analysis and ensuring all incident reports are complete and written within standard operations and ensures ticket audits and reviews are completed
 </li>
 <li>
 Utilizes leading forensic software to identify, collect, preserve and analyze electronic data from laptops, desktops, servers, email archives, infrastructure logs, network file servers, backup tapes, cell phones, PDAs and a wide variety of other media devices.
 </li>
 <li>
 Manages requests for electronic data and digital forensic investigations that relate to Litigation, Regulatory matters, Compliance, and Employee Investigations.
 </li>
 <li>
 Performs cybersecurity incident analysis and assist with incident response, including analysis of network content and metadata for investigations or malware detection and identifies the cause and extent of a breach.
 </li>
 <li>
 Serves as a subject matter expert and technical advisor in matters relating to the proper collection, preservation, packaging, and submission of digital and multimedia evidence.
 </li>
 <li>
 Participates in incident electronic evidence collection activities in major field investigations. Ensures evidence handling requirements are met.
 </li>
 <li>
 Performs post-incident report according to standard operations.
 </li>
 <li>
 Analyzes the tools and methodology used for investigation and accordingly presents improvements in control and corrective actions if any.
 </li>
 <li>
 Escalates and works with senior management on resolutions to overdue security items or any negative trends identified.
 </li>
 <li>
 Develops focused reporting and briefings for advanced cyber threats.
 </li>
 <li>
 Conducts studies and research for improving forensic analyses, scientific methods, and resolving forensic examination problems.
 </li>
 <li>
 Creates detailed, professional documentation and reports, including performance metrics and presentations for management.
 </li>
 <li>
 Leads or contributes to key projects related to corporate threat monitoring, forensics or information security initiatives.
 </li>
 <li>
 Facilitates group risk assessment activities and identifies any security-related process improvement opportunities.
 </li>
 <li>
 Monitors and performs trending on root cause analysis activities within assigned group and participates as needed to resolve clinical systems security related incidents.
 </li>
 <li>
 Assists on monitoring compliance with information security policies, standards and ENTERPRISE-WIDE strategy and facilitates threat and vulnerability evaluations on a regular basis. Measures and reports on the effectiveness of information security controls.
 </li>
 <li>
 Supports the security initiatives, corrective and preventative actions, and security measures by ensuring timely updates and escalating concerns and non-compliances.
 </li>
 <li>
 Understands and maintains the appropriate knowledge of Security Technologies, (Firewall, Anti-Virus, Email and Web Encryption, HIPS, NIPS, SIEM, WAF, DLP), security procedures, and services within Naufar IT Security as well as ensures all tools are functioning properly.
 </li>
 <li>
 Keeps up to date on changes to significant regulatory and applicable standards issued by internal or external agencies, as applicable to the Naufar&rsquo;s domain.
 </li>
 <li>
 Adheres to Naufar&rsquo;s standards as they appear in the Code of Conduct and Conflict of Interest policies
 </li>
 </ul>
 
 
 
 
 
 Academic Qualifications:
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree &ndash; IT - Mandate
 </li>
 <li>
 Master&rsquo;s degree &ndash; Cybersecurity - Desired
 </li>
 </ul>
 
 
 
 
 
 Experience Requirements:
 
 
 <ul>
 <li>
 8+ years of experience working as a security analyst or SME within a Security Operations Center with exposure to cyber security collection, analysis and threats management, investigation and digital forensics.
 </li>
 <li>
 Demonstrated experience in threat detection and analysis, incident response, and reporting.
 </li>
 <li>
 Demonstrated experience with incident response, deep dive forensics, insider threat, cyber and data exfiltration incidents.
 </li>
 <li>
 Demonstrated experience conducting assessments, digital forensic investigations, vulnerability management and incident response.
 </li>
 <li>
 Demonstrated experience with current cyber threats and the associated tactics, techniques, and procedures used to infiltrate computer networks.
 </li>
 <li>
 Demonstrated experience with SEIM products in the detection, response, mitigation, and/or reporting of cyber threats
 </li>
 <li>
 Demonstrated experience in the use of forensic tools (e.g. FTK, Encase, Forensic Toolkit, X-Ways, Linux based tools, etc.)
 </li>
 <li>
 Experienced with (or equivalent) the following regulations and frameworks: PCI, HIPAA, and ISO/IEC 2700x
 </li>
 </ul>
</div>

Cyber Security Analyst

Peraton

<div>About Peraton 
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can't be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we're keeping people around the world safe and secure. 
 
Program Overview 
Encompasses technical, engineering, data analytics, cyber security, management, operational, logistical, and administrative support for Bureau of Diplomatic Security, Cyber and Technology Security Directorate in three key offices/functional areas: Cyber Monitoring and Operations, Cyber Threat and Investigations, and Technology Innovation and Engineering State. 
 
About The Role 
 
Peraton is currently seeking to hire a Sr Digital Forensic Analyst for its' Federal Strategic Cyber program.
 
 
Location: Arlington, VA - full-time, on-site role.
 
 
This Federal Strategic Cyber program encompasses technical, engineering, data analytics, cyber security, management, operational, logistical, and administrative support to aid and advise the Cyber &amp; Technology Security (CTS) Directorate. This includes protecting a global cyber infrastructure comprising networks, systems, information, and mobile devices all while identifying and responding to cyber risks and threats.
 
 
In this role, you will:
 
 
<ul><li>Serve as a senior-level digital forensic analyst conducting examinations on digital data from a variety of sources, including cellphones, tablets, computers, storage media, cloud data, and others.
</li><li>Apply recognized scientific practices for the identification, analysis, interpretation, and presentation of digital data.
</li><li>Analyze data in various examination contexts, including criminal, civil, and administrative requests.
</li><li>Perform detailed analysis of digital data in accordance with requestors' directions and search warrant specifications/limitations.
</li><li>Practice and be proficient with industry-standard forensic tools for the extraction and examination of digital data, such as Cellebrite Inseyets, Oxygen Forensic Detective, Magnet Forensics Graykey and Axiom, Nuix, X-ways, and others.
</li><li>Be proficient in the analysis of various mobile and computer operating systems, file systems, and third-party application databases.
</li><li>Write comprehensive reports of examination processes and findings for use by investigators, prosecutors, and other stakeholders in federal, state, and local judicial proceedings.
</li><li>Be able to provide expert witness testimony, explaining examination procedures and evidence interpretations to a lay audience.
</li><li>Provide on-site support during search warrant executions by identifying, collecting, packaging, documenting, and ensuring the chain of custody for digital evidence.
</li><li>Collaborate with program leadership and fellow forensic analysts to ensure that CIF maintains forensically-sound procedures and best practices in the acquisition, analysis, and presentation of digital evidence.
</li><li>Conduct thorough peer and media dissemination reviews of forensic reports and analysis artifacts to ensure high-quality work prior to customer delivery.
</li><li>Mentor new hires by sharing expertise and guiding them through CIF workflows and practical exercises to ensure a successful on-boarding process.
</li><li>Share insights and best practices with other analysts to enhance team knowledge and performance.
</li><li>Stay current with new developments and trends in digital forensics, cybersecurity, forensic law, mobile devices and applications, social media tools, and encryption/decryption methods.
</li></ul> 
Qualifications 
 
Minimum:
 
 
<ul><li>Bachelor's degree and a minimum of 9 years of experience as a digital forensic examiner in performing mobile and non-mobile analysis.
</li><li>An additional four years of experience may be substituted in lieu of degree.
</li><li>Minimum of one of the following approved forensic certifications:
</li><li>GIAC: GCFE, GASF
</li><li>IACIS: CFCE, ICMDE
</li><li>NCFI: BCERT, MDE
</li><li>DC3: CDFE, CDMC
</li><li>Opentext: EnCE
</li><li>Cellebrite: [CCO &amp; CCPA], CCME
</li><li>Oxygen Forensics: OFC
</li><li>Magnet Forensics: MCFE
</li><li>Demonstrated ability with mobile and non-mobile forensic software tools such as Magnet Axiom, Cellebrite, Oxygen, and with mobile advanced extraction hardware and software tools.
</li><li>Knowledge of Windows and MacOS, Apple iOS, Android operating systems, Android Debug Bridge (ADB), iTunes, and iCloud and Windows Backups.
</li><li>Experience writing detailed reports that simplify complex technical information to non-technical audiences.
</li><li>Demonstrated strong critical thinking, creativity, sound decision-making, and situational awareness to seek leadership guidance when needed.
</li><li>Ability to collaborate with individuals at all levels and interact tactfully, courteously, and professionally with peers and CIF end-customers.
</li><li>Ability to travel for on-scene seizures of digital evidence, training, and/or testimony.
</li><li>Serve as a senior-level digital forensic analyst, having 9+ years of experience performing mobile and non-mobile device forensics in a criminal forensic laboratory.
</li><li>Conduct digital forensic analysis of various mobile devices, computer systems, and storage media including cloud data, performing digital forensic analysis across various types of cases involving both mobile and non-mobile devices.
</li><li>Proficient in industry-standard forensic examination tools such as Cellebrite, Oxygen, Nuix, Axiom, and X-ways and similar to perform in-depth digital forensic analysis of various mobile and computer operating systems, file systems, iOS, and third-party application databases.
</li><li>Experience conducting forensic examinations on mobile and non-mobile digital evidence through the application of recognized scientific practices for the identification, analysis, interpretation, and presentation of digital evidence for criminal, civil, and administrative purposes.
</li><li>Experience providing on-site support during search warrants by identifying, collecting, packaging, handling, documenting, and ensuring the chain of custody for digital evidence.
</li><li>Experience preparing detailed reports and exhibits for judicial proceedings and provide expert testimony to explain forensic findings to non-expert audiences.
</li><li>Experience collaborating with leadership, forensic analysts, law enforcement, prosecutors, and stakeholders to deliver the highest-quality product to the customer.
</li><li>Amenable and able to stay updated on advancements in digital forensics, cybersecurity, forensic law, mobile devices, social media tools, applications, and encryption technologies.
</li><li>U.S. citizenship required.
</li><li>Ability to obtain an interim Secret clearance before start date.
</li><li>Ability to obtain a final Top-Secret security clearance.
</li></ul> 
Preferred:
 
 
<ul><li>At least one additional vendor or vendor-neutral certification is preferred but not required. This certification may come from (but is not limited to) a certification from the above or from of following:
</li><li>Cyber Crime Center (CDFE, CDMC)
</li><li>Cellebrite (CCO+CCPA)
</li><li>X-Ways (X-PERT)
</li><li>Oxygen Forensics (OFC)
</li><li>Magnet Forensics (MCFE)
</li></ul> 
SCA / Union / Intern Rate or Range 
 
Details 
 
Target Salary Range: $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
 
 
EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</div>

Senior Digital Forensic Analyst

Search 4800+ Cyber defense forensics analyst jobs near you this November. New roles added regularly across leading industries. Apply today.