NetWitness Cyber Incident Response Analyst (Senior)
Washington, DC
Full Time Senior-level / Expert Clearance required USD 63K - 147K *
cFocus Software Incorporated
Our exclusive ATO as a Service™ software & expert services automate FISMA RMF & FedRAMP compliance.
cFocus Software seeks a NetWitness Cyber Incident Response Analyst (Senior) to join our program supporting the Administrative Offices of the United States Courts in Washington, DC. This position requires an active Public Trust clearance.
Qualifications:
Qualifications:
- Bachelor’s Degree or equivalent experience in a computer, engineering, or science field.
- Active Public Trust clearance.
- NetWitness Certified XDR Administrator
- Hold active certifications such as GCIA or GCIH or GSEC or GMON, and Splunk Core Power User.
- 7+ years of relevant experience.
- Assist with implementation of RSA NetWiitness
- Perform a binary analysis and produce a report on what are the exploits that could potentially be available to an attacker and countermeasures to mitigate the exposure of those exploits
- Support the development of staff schedules and staffing forecasts for approval.
- Ensure shift members follow the appropriate incident escalation and reporting procedures.
- Provide support promptly and efficiently through front-line telephone and email communications.
- Assist with knowledge management – Standard Operating Procedures and procedural support data.
- Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or ServiceNow) for advanced subject matter expert (SME) technical investigative support for real-time incident response (IR).
- IR includes cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (e.g., Zscaler).
- Create duplicates of evidence that ensure the original evidence is not unintentionally modified. AOUSC supplied procedures and tools shall be used to acquire the evidence.
- Analyze forensic artifacts of operating systems (e.g., Windows, Linux, and macOS) to discover elements of an intrusion and identify root cause.
- Perform live forensic analysis based on SIEM data (e.g., Splunk).
- Perform filesystem timeline analysis for inclusion in forensic report.
- Extract deleted data using data carving techniques.
- Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC.
- Perform static and dynamic malware analysis to discover indicators of compromise (IOC).
- Analyze memory images to identify malicious patterns using Judiciary tools (e.g. Volatility). Analysis results documented in forensics report.
- Write forensic and malware analysis reports.
* Salary range is an estimate based on our InfoSec / Cybersecurity Salary Index 💰
Job stats:
4
0
0
Categories:
Analyst Jobs
Incident Response Jobs
Tags: Active Directory Azure Clearance Cloud EDR Exploits Forensics GCIA GCIH GSEC Incident response Linux MacOS Malware RSA SIEM Splunk Windows XDR
Region:
North America
Country:
United States
More jobs like this
Explore more career opportunities
Find even more open roles below ordered by popularity of job title or skills/products/technologies used.
Security Operations Engineer jobsInformation Security Officer jobsInformation Systems Security Officer jobsInformation Security Specialist jobsSenior Cybersecurity Engineer jobsInformation System Security Officer jobsSenior Cyber Security Engineer jobsSenior Network Security Engineer jobsSecurity Consultant jobsPrincipal Security Engineer jobsIT Security Engineer jobsSenior Penetration Tester jobsSecurity Specialist jobsChief Information Security Officer jobsCyber Security Specialist jobsSenior Information Security Analyst jobsCloud Security Architect jobsStaff Security Engineer jobsInformation System Security Officer (ISSO) jobsCybersecurity Consultant jobsCyber Security Architect jobsIT Security Analyst jobsSecurity Operations Analyst jobsThreat Intelligence Analyst jobsSenior Product Security Engineer jobs
SaaS jobsEncryption jobsSDLC jobsRMF jobsMalware jobsGDPR jobsIDS jobsEDR jobsSplunk jobsIPS jobsSQL jobsForensics jobsBash jobsTop Secret jobsITIL jobsDoDD 8570 jobsFinance jobsOWASP jobsIntrusion detection jobsTerraform jobsDocker jobsUNIX jobsCRISC jobsCompTIA jobsTCP/IP jobs
Active Directory jobsSANS jobsThreat detection jobsPolygraph jobsOSCP jobsGIAC jobsBanking jobsJavaScript jobsSOAR jobsClearance Required jobsAnsible jobsVPN jobsData Analytics jobsSOX jobsArtificial Intelligence jobsHIPAA jobsDNS jobsSOC 2 jobsCCSP jobsJira jobsMachine Learning jobsMITRE ATT&CK jobsIT infrastructure jobsCISO jobsGCIH jobs