Cyber Defense Forensics Analyst

About the role

The Cyber Defense Forensics Analyst works within the Cybersecurity Operations capability to support incident response, threat analysis, and digital evidence processing for global C4ISR operations. The role follows DoDM 8140.03 standards and handles classified information.

Key responsibilities

• Execute digital forensic collections, host‑based memory analysis, disk image acquisition, and reverse engineering during security incidents.
• Maintain strict evidence handling and chain‑of‑custody protocols for all artifacts, network captures, and memory dumps.
• Analyze disk images, volatile memory, system logs, and network traffic to reconstruct attack vectors, timelines, and breach impact.
• Provide technical support for isolating, containing, eradicating, and recovering from security events.
• Author comprehensive forensic investigation reports and contribute to formal Security Incident Reports.

Required profile

• Technical degree in Cybersecurity, Computer Science, IT, or related field, or 5+ years of operational digital forensics experience.
• Intermediate proficiency (DCWF Work Role 612) with required certifications such as CySA+, GCFA, EnCE, CCE.
• Ability to work with classified data under AR 380‑5 and DoDI 5200.48 guidelines.

Required skills

• Digital forensics and artifact collection
• Host‑based memory analysis
• Disk imaging and reverse engineering
• Evidence handling and chain‑of‑custody procedures
• Threat analysis and attack timeline reconstruction
• Incident response technical support