Cyber Defense Forensics Lead (R-00149)

Position Description

• Lead digital forensics activities in support of cyber defense and incident response efforts 
• Analyze digital evidence related to cybersecurity incidents and investigative activity 
• Support incident response and threat hunt activities through forensic analysis and technical findings 
• Conduct forensic review of systems, artifacts, logs, and related evidence sources 
• Use the Cyber Kill Chain and MITRE ATT&CK to help frame investigative findings, support hunt hypotheses, and communicate attacker actions, progression, and control gaps 
• Prepare technical summaries, findings, and reports to support operational and leadership decision-making 
• Support evidence handling, documentation, preservation, and chain-of-custody practices 
• Coordinate with cyber defense, incident response, and government stakeholders as needed 
• Help identify vulnerabilities, attack methods, and technical indicators revealed through forensic analysis 
• Support post-incident review, reporting, and remediation discussions with relevant stakeholders 
• Support continuous improvement of forensic processes, documentation, and operational practices 

Position Qualifications

 
• • 5–7 years of experience in digital forensics, incident response, and threat hunt activities 
  • Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or related field; or equivalent experience 
  • Core competencies in computer forensics, computer network defense, software testing and evaluation, system administration, and threat analysis 
  • Experience conducting forensic analysis in support of cybersecurity incidents 
  • Experience using MITRE ATT&CK and the Cyber Kill Chain to contextualize attacker behavior, investigative findings, and post-incident analysis 
  • Experience preparing technical findings and investigative reporting 
  • Ability to work effectively in classified environments within government controlled secure facilities 
  • Strong analytical, documentation, and evidence-handling discipline 
  • Ability to support high-priority incident and investigative tasking under time pressure 

  Preferred Certifications
  GCFA, GNFA, GCIH, EnCE, CISSP, CASP, or comparable certifications