Mindpoint Group, LLC has an exciting opportunity to join the Research and Forensics team of one of our clients in the Atlanta, Georgia area. This position is critical to the continued maturation of the clients operational capabilities and you will join an established and experienced group that is motivated to provide excellent services in defending federal infrastructure. You will work closely with other research and forensics analysts, threat hunters, threat analysts an established SOC and we will rely on you to examine recovered data and to perform forensics analysis.

What you get to do every day:

• Decrypt seized data using technical means
• Provide a technical summary of findings in accordance with established reporting procedures
• Ensure that chain of custody is followed for all digital media acquired in accordance with the Federal Rules of Evidence
• Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration
• Perform dynamic analysis to boot an “image” of a drive to see the intrusion as the user may have seen it in a native environment
• Perform static analysis to mount an "image" of a drive (without necessarily having the original drive)
• Perform file signature analysis and hash comparison against the established database
• Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs)
• Perform tier 1, 2, and 3 malware analysis
• Extract data using data carving techniques (e.g., Forensic Tool Kit [FTK])
• Capture and analyze network traffic associated with malicious activities using network monitoring tools such as RSA Netwitness and Splunk
• Utilize deployable forensics toolkits to support operations as necessary
• Perform Windows registry and file analysis
• Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.

Qualifications

**Applicable US Government Clearance required**

What skills are required?

• Bachelor’s Degree in CS-related field preferred. Experience may be considered in lieu of a degree
• Minimum of six (6) years of general work experience and three (3) years of experience in digital forensics, incident response, and threat hunt activities
• Demonstrated competency in forensic tools like Encase and Wireshark
• Core Competencies in computer forensics, computer networking, and operating systems.
• Experience with operational security, including security operations center (SOC), incident response, malware analysis, or IDS and IPS analyses
• Understanding of scripting languages such as Python and regular expressions
• Knowledge of Windows and Linux OS’ and command lines

What is ideal?

• Certifications Desired:
• CISSP - Certified Information Systems Security Professional
• GCFA - GIAC Certified Forensic Analyst
• GCFE - GIAC Certified Forensic Examiner
• GREM - GIAC Reverse Engineering Malware
• GNFA - GIAC Network Forensic Analyst
• Splunk Core Certified User
• Splunk Core Certified Power User

Location:

• This position is initially fully remote. However, you will be required to be on-site in Atlanta, GA when requested to conduct hands-on forensics analysis.

Job Type: Full-time

Experience:

• digital forensics: 3 years (Required)
• Incident response: 3 years (Required)

Security clearance:

• Top Secret (Required)

Work Location: Hybrid remote in Atlanta, GA 30303