Cyber Security Forensics Analyst

ManTech - Stennis Space Center, MS

Full-time - Mid Level

Stennis Space Center, MS

Professional, Scientific, and Technical Services

About the position

The Cyber Security Forensics Analyst at ManTech plays a critical role in safeguarding national security by conducting advanced digital forensics investigations and analyzing cyber threats. This position involves utilizing frameworks such as MITRE ATT&CK and MITRE D3FEND to develop strategies for risk mitigation and collaborating with various stakeholders to enhance cybersecurity measures. The analyst will lead investigations, perform malware analysis, and produce detailed reports to inform decision-making and response efforts.

Responsibilities

• Lead and conduct complex digital forensics investigations, including data recovery, analysis, and reporting.
• Utilize the MITRE ATT&CK framework and other techniques to identify, assess, and address cyber threats and vulnerabilities.
• Apply the MITRE D3FEND framework to develop and implement defensive measures against cyber threats.
• Collaborate with other cybersecurity professionals, law enforcement agencies, and intelligence organizations to share information and coordinate response efforts.
• Conduct technical analysis against target systems and networks, identify vulnerabilities, and support the development of new exploitation techniques.
• Analyze cyber activities to identify entities of interest, determine malicious behavior, and recognize patterns and linkages.
• Conduct dynamic malware analysis and perform memory and dead-box forensics.
• Investigate computer and information security incidents to determine the extent of compromise to information and automated information systems.
• Perform long-term and time-sensitive in-depth technical analysis of malicious code (malware), developing defensive countermeasures, and producing reports for dissemination.
• Using static and dynamic methodologies for malware analysis, such as debuggers, disassemblers, and sandbox execution.
• Write forensics and incident response reports, investigate computer attacks, and extract data from electronic systems.
• Perform technical analysis on suspicious or unknown activities.
• Draft and brief contract and government leadership, as needed.
• Collaborate with the Splunk team to implement, enhance, or change existing use cases.
• Assess scope of malware campaigns and determine necessary remediation actions.
• Conduct remote compromise assessments and produce assessment reports.
• Develop and maintain standard operating procedures (SOPs) and rules of engagement (ROE) templates.
• Cross-train and mentor other forensic analysts and staff on analysis, tools, and reporting.

Requirements

• An 8570 compliant certification in IAT Level III.
• One of the following relevant certifications: GIAC Certified Forensic Analyst (GCFA), Certified Information Systems Security Professional (CISSP), or Certified Cyber Forensics Professional (CCFP).
• A bachelor's degree in computer science, engineering, information technology, cybersecurity, or related field of study.
• A minimum of 9 years of progressively responsible experience in cyber security, incident response, or forensic investigations including malware analysis.
• Knowledge and experience with Threat Intel Frameworks (e.g. Cyber Kill Chain, MITRE ATT&CK, Diamond Model).
• Demonstrated experience using EnCase, FTK, and Open-Source methods and tools to perform computer forensic investigations.
• Experience with Splunk, CrowdStrike Falcon, Security Onion, EnCase, Axiom, FTK, Volatility, or Suricata.
• Proficient with Windows and Linux operating systems.
• Experience with network topologies and network security devices (e.g. Firewall, IDS/IPS, Proxy, DNS, WAF, etc).