Location

What You'll Do

• Conduct analysis of log files, evidence, and other information to determine best methods for identifying the perpetrator(s) of a network intrusion
• Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is not unintentionally modified, to use for data recovery and analysis processes
• Decrypt seized data using technical means
• Provide technical summary of findings in accordance with established reporting procedures
• Ensure that chain of custody is followed for all digital media acquired in accordance with the Federal Rules of Evidence
• Perform file signature, static media, and malware analysis
• Extract data using data carving techniques
• Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence
• Perform Windows registry analysis
• Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise
• Additional responsibilities as necessary

What You Can Expect

Minimum Job Requirements

Preferred Job Requirements

• Ability to conduct forensic analyses in both Windows and Unix/Linux environments
• Knowledge of processes for seizing and preserving digital evidence, including legal governance related to admissibility (e.g. Rules of Evidence)
• Knowledge of hacking methodologies
• Knowledge in analyzing memory dumps to extract information
• Knowledge of encryption algorithms
• Experience using forensic tool suites (e.g., EnCase, and FTK)
• Ability to perform both bit-level analysis and packet-level analysis
• Experience with analyzing malware and identifying anomalous code as malicious or benign
• Experience with reverse engineering concepts
• Knowledge of system administration concepts for operating systems such as but not limited to Unix/Linux, IOS, Android, and Windows operating systems
• Ability to identifying obfuscation techniques
• Ability to perform Windows registry analysis
• Ability to use virtual machines and decrypt digital data collections
• Strong problem solving and communication skills (both orally and in writing)

Notes