ClearFocus Technologies, a HUBZone certified company, is located in Leesburg, VA. We specialize in cybersecurity and support multiple government and commercial clients for a variety of missions. We value our clients, integrity and employees and believe a single person can make a difference! We are committed to attracting and retaining the best and brightest talent who desire to work with industry leading technology to stay on top of their profession. We provide an excellent benefit package which includes medical, dental, vision, paid time off, 401(k), paid professional development reimbursement and more! We are seeking aJourneyman Digital/Cyber Forensics Analyst foran opportunity in Las Vegas, Nevada. All applicants must have an active Top Secret clearance and bachelor or higher degree.
Position Overview: We are seeking a skilled Journeyman Digital Forensics and Incident Response (DFIR) Analyst to join our team in Las Vegas, NV. In this role, you will perform deep-dive host forensics, enterprise incident triage, and large-scale network log analysis within a centralized SIEM environment to detect, investigate, and contain advanced cyber threats.
Key Responsibilities:
- Incident Response & Host Forensics: Conduct forensic acquisitions (disk, memory, and volatile artifacts) from workstations, servers, and cloud environments in accordance with standard chain-of-custody procedures.
- Network & SIEM Analysis: Query, correlate, and analyze multi-source logs (firewalls, proxies, DNS, Active Directory/authentication, EDR, and netflow) inside enterprise SIEM platforms to scope incidents and trace threat actor activity.
- Timeline Reconstruction: Analyze file systems, system logs, registry hives, shellbags, prefetch, and browser history to build comprehensive intrusion timelines.
- Network Packet Inspection: Inspect full-packet captures (PCAP) and protocol metadata (e.g., Zeek/Bro) to identify command-and-control (C2) traffic, lateral movement, and data exfiltration.
- Adversary Mapping: Map adversary behavior to the MITRE ATT&CK framework and extract Indicators of Compromise (IOCs) for threat hunting and detection engineering.
- Reporting & Briefing: Author detailed forensic investigation reports, root-cause analyses, and technical summaries for technical teams and leadership. Support legal proceedings or law enforcement escalation when required.
Required Qualifications:
- Experience: Minimum of 4 years of hands-on experience in digital forensics, incident response, or advanced SOC tier 2/3 operations.
- Education: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related technical discipline (equivalent military/work experience may be substituted).
- Clearance: Active or able to obtain a U.S. Government Top Secret clearance/Q.
- SIEM Proficiency: Hands-on experience constructing queries, hunting, and correlating security events in SIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic Stack).
- Forensic Tooling: Demonstrated proficiency with forensic suites and triage tools (e.g., Magnet AXIOM, EnCase, FTK, KAPE, Velociraptor, or Volatility).
- Network Analysis: Solid understanding of TCP/IP protocols, network security architectures, and packet analysis tools (e.g., Wireshark, Zeek).
Preferred / Desired Qualifications:
- Active GIAC certifications: GCFA (Certified Forensic Analyst), GCFE (Certified Forensic Examiner), GNFA (Network Forensic Analyst), or GCIH (Certified Incident Handler).
- Experience with enterprise Endpoint Detection & Response (EDR) platforms (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne).
- Experience analyzing artifacts in Windows, Linux, and cloud infrastructure (AWS, Azure, M365).
- Familiarity with basic scripting (PowerShell, Python, or Bash) to parse artifacts or automate routine triage tasks.