Attack Sensing & Warning Analyst

Who you'll be:

We are seeking a Forensics Specialist to join our Cyber Defense Forensics (CDF) team supporting a federal agency's security operations center. In this entry-level forensics role, you will support enterprise and endpoint digital forensic analysis under the guidance of senior forensic analysts, contributing to investigations involving malware, insider threats, and data loss events across Windows, Linux, Mac, and cloud environments. This is an ideal opportunity for an early-career analyst to build hands-on forensic skills in a fast-paced, mission-critical environment, with structured mentorship and a clear path toward Tier 2 and Tier 3 responsibilities.

What you'll do: 

• Conduct endpoint and network-based digital forensic analysis in support of Cyber Defense Forensics or Insider Threat investigations, under supervision.
• Leverage commercially available and open-source forensic tools to perform forensic analysis tasks efficiently and accurately. 
• Assist with maintaining the SOC's forensics lab equipment, including imaging stations and forensic workstations.
• Assist with performing static and dynamic file analysis to identify malware characteristics, intent, and origin.
• Support categorizing, prioritizing, and reporting on security events in accordance with established forensics SOPs.
• Assist with performing antivirus scans on maintenance software files prior to use on the enterprise network.
• Support pre- and post-travel scans of agency-issued laptops and mobile devices for authorized personnel travel.
• Document findings clearly and accurately in case notes and draft sections of formal investigation reports for senior review.

What you need:

• US Citizenship; BS degree (or 4 years of additional experience as substitute)
• A minimum of one (1) year of professional experience in network or UNIX/Linux system administration, software engineering, software development, and/or a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or related field.
• Working knowledge of TCP/IP protocols, security methodologies, and experience configuring technical security solutions.
• Proficiency in at least one programming language, familiarity with reverse engineering tools and open-source computer forensic tools.

Nice to have:

• Exposure to at least one commercial forensic toolkit (FTK, EnCase, Cellebrite, or similar).
• Coursework or hands-on lab experience with digital forensics and incident response (DFIR) fundamentals.
• Basic scripting ability (Python, PowerShell, or Bash) to support evidence processing and analysis workflows.

Required Certifications:

• One or More: CompTIA A+, Network+, Security+, GSEC, SSCP.