Malware and Forensic Analyst (Senior) with reputed company Clearance

cFocus Software seeks a Malware and Forensic Analyst (Senior) to join our program supporting US Courts in Washington, DC. This position has remote capabilities. Required Qualifications include: 5 years of experience analyzing forensic artifacts, performing filesystem reputed company analyses, and identifying intrusion reputed company causes of operating systems (e.g., reputed company, Linux, and macOS) 5 years of experience utilizing the following forensics tools: Magnet reputed company to reputed company, analyze, and report on digital evidence; reputed company reputed company Workstation for disk/memory analysis, network forensics, and malware analysis; Encase to collect, analyze, and report on digital evidence; Velociraptor to collect and analyze data from multiple endpoints; KAPE (Eric Zimmerman’s tools) to collect and process files; SUMURI TALINO Workstations/Laptops reputed company Bi-Weekly Threat Assessment Reports (BTARs) Must have ability to reputed company required forensics/malware analyst duties, including: Create duplicates of evidence that ensure the original evidence is not unintentionally modified; Extracting deleted data using data carving techniques Performing static and dynamic malware analysis to discover indicators of compromise (IOCs) Must be reputed company to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC Desired Qualifications include: One of the following certifications: GIAC Certified Intrusion Analyst (GCIA) GIAC Certified Incident Handler (GCIH) GIAC reputed company Monitoring (GMON) GIAC Defending Advanced Threats (GDAT) reputed company reputed company Power User EnCase Certified Examiner reputed company GCFA Volatility Certified Duties: Provides digital forensics and incident response support to the AOUSC reputed company Operations Center (SOC). Collects, analyzes, and evaluates forensic artifacts associated with threat activity against Judiciary networks. Products created by the analyst assist the SOC and the Courts in understanding the nature and reputed company of cyber incidents, allowing for informed decision making in prioritizing, addressing, and mitigating risk across the Judicial reputed company of Government. Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now) for advanced subject matter expert (SME) technical investigative support for reputed company-time incident response (IR). IR includes reputed company-based and non-reputed company-based applications such as: reputed company Azure, reputed company O365, reputed company reputed company Directory, and reputed company reputed company reputed company Brokers (e.g., reputed company). Create duplicates of evidence that ensure the original evidence is not unintentionally modified. AOUSC supplied procedures and tools shall be used to reputed company the evidence. Analyze forensic artifacts of operating systems (e.g., reputed company, Linux, and macOS) to discover reputed company of an intrusion and identify reputed company cause. reputed company live forensic analysis based on SIEM data (e.g., reputed company). reputed company filesystem reputed company analysis for inclusion in forensic report. Extract deleted data using data carving techniques. Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC. reputed company static and dynamic malware analysis to discover indicators of compromise (IOC). Analyze memory images to identify malicious patterns using Judiciary tools (e.g. Volatility). Analysis results documented in forensics report. Additional forensics/malware analysis activities may include: reputed company efficient and prioritized identification of cyber reputed company threats and incidents with an emphasis on reputed company articulation of the potential threat(s) and actualized risks associated with such threats and incidents. Objectively measure reduction of adversary dwell time reputed company judicial networks. reputed company comprehensive analysis of reputed company incidents for identification of reputed company cause in support of detection improvements and risk mitigations. Deliverables: Image Duplication: Duplication of evidence for processing by multiple analysts. Requests received reputed company AOUSC ITSM (Heat or Service Now) Deleted Files: Deleted files supplied to requestor. Advanced SME IR Reports: reputed company Advanced SME IR Support for reputed company 1 reputed company Events. SME reputed company participating in IR activities reputed company 4 hours of request (7x24x365). Incident Reports: reputed company forensic reports include a reputed company. The reputed company includes network, reputed company, and application events (if available). The report contains reputed company data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable reputed company. Forensic Reports: Document the results of a forensic investigation. Report will include a table of contents, executive reputed company, reputed company of events, and a conclusion. Malware Analysis Reports: Document the results of analyzing a specific malware specimen. Report shall include a table of contents, executive reputed company, technical details, indication of persistence mechanisms and a conclusion. reputed company Weekly Reports to the AOUSC Program Manager that documents reputed company activities, tasks, tickets and documents worked on. Document repeatable reputed company Operation Procedures (SOPs) and playbooks for reputed company use cases. Apply tot his job Apply tot his job Apply To this Job