{"id":983001,"url":"https://alion.io/job/agiledefense-digital-forensics-and-incident-analyst-ts","title":"Digital Forensics and Incident Analyst (Active Top Secret Required)","company":{"id":716156,"name":"Agile Defense","domain":"agiledefense.com","url":"https://alion.io/company/agiledefense","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":81,"open_postings":37,"ghost_share":0,"stale_share":0.757,"repost_share":0,"time_to_fill_p50_days":41,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":118000,"max_usd":225000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1385},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EC2","optional":false},{"name":"Autopsy","optional":false},{"name":"Defense in Depth","optional":false},{"name":"EnCase","optional":false},{"name":"FTK","optional":false},{"name":"Ghidra","optional":false},{"name":"Hyper-V","optional":false},{"name":"IDA Pro","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"The Sleuth Kit","optional":false},{"name":"Unix","optional":false},{"name":"VMWare","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false},{"name":"X-Ways Forensics","optional":false},{"name":"Xen","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"AWS","optional":true}],"status":"live","first_seen_at":"2026-07-18T01:34:25Z","employer_posted_date":"2026-07-18","last_verified_at":"2026-10-30T22:52:18Z","board_verified":true,"closed_at":null,"days_open":104,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":104},"description":"Requisition #:\nJob Title: Digital Forensics and Incident Analyst\nLocation: Onsite, Washington, DC\nClearance: Top Secret\nDescription\nThe Digital Forensics & Incident Analyst supports the Threat Analysis & Investigations (TA&I) function, analyzing digital evidence and investigating computer security incidents to derive information that supports system and network vulnerability mitigation. The analyst provides Tier 2 and Tier 3 support to the enterprise Security Operations Center (SOC) and coordinates with partner/enterprise security operations centers as required for incident response and advanced analysis. Aligned to the NICE Framework, the role identifies, collects, examines, and preserves digital evidence using controlled and documented analytical and investigative techniques in support of authorized requesting authorities - including oversight bodies, legal and general counsel offices, professional-responsibility offices, FOIA requests, and law enforcement partners. The analyst conducts digital analysis in response to investigations of computer-based crimes and cyber-intrusion incidents, leveraging enterprise forensic and live-monitoring tools while rigorously maintaining chain of custody. Incoming requests are logged into a case management application, and the analyst performs the analytical function supporting the appropriate authorities.\nEssential Functions\nAnalyze log files, evidence, and other information to determine the best methods for identifying the perpetrator(s) of a network intrusion. (T0027)\nConfirm what is known about an intrusion and discover new information via dynamic analysis. (T0036)\nProvide technical summaries of findings in accordance with established reporting procedures, and deliver written analysis reports to requesting customers. (T0075)\nExamine recovered data for information relevant to the matter at hand. (T0103)\nPerform file signature analysis (T0167) and file system forensic analysis across implementations such as NTFS, FAT, and EXT. (T0286)\nCollect and analyze intrusion artifacts (e.g., source code, malware, system configuration) and use discovered data to enable mitigation of potential cyber defense incidents. (T0432)\nConduct malware analysis in the event of a compromise, identify obfuscation techniques, and interpret debugging results to ascertain adversary tactics, techniques, and procedures.\nDetermine the extent of threats and recommend courses of action or countermeasures to mitigate risk; analyze crises to ensure public, personal, and resource protection.\nIdentify data concealment methods (e.g., encryption algorithms, steganography) and conduct memory dumps to extract information.\nConduct security event analysis and correlation using enterprise tooling, and apply network security architecture concepts (topology, protocols, components, defense-in-depth) to forensic analysis.\nDetermine physical computer components and architectures, conduct physical disassembly of systems, and identify/modify/manipulate system components within Windows, Unix, or Linux (e.g., passwords, user accounts, files).\nApply system administration, network, and operating-system hardening techniques, and use virtual machines (e.g., Hyper-V, VMware vSphere, Citrix Xen, Amazon EC2) in the course of analysis.\nConduct hashing for chain-of-custody and validation (e.g., SHA, MD5) and preserve evidence integrity according to standard operating procedures or national standards.\nSupport the full evidence lifecycle - collecting, packaging, transporting, and storing electronic evidence while maintaining chain of custody - and interpret insider-threat investigations, reporting, tools, and applicable laws/regulations.\nProvide legal governance related to admissibility (e.g., Rules of Evidence) and advise on applicable laws and statutes (e.g., Titles 10, 18, 32, and 50, U.S. Code), Presidential Directives, and executive/administrative/criminal guidelines.\nProvide risk-management recommendations and apply knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.\nSupport forensic application updates and replacements as technology changes; develop workflow diagrams and requirements for continued case management application growth; and support contingency and recovery planning for enterprise forensic and case management applications.\nSupport solution evaluation and piloting - identify key technology components, review and update the System Design Document, assist the ISSO with assessment and authorization (A&A) functions to establish Authority to Test, pilot components to a limited user community, and deliver findings and recommendations to the TA&I Program Manager and staff for review.\nQualifications\nU.S. citizenship and an active Top Secret (TS) security clearance.\nBachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Systems, or a related field (additional experience may substitute for degree).\n 7 years of hands-on digital forensics and incident response (DFIR) experience, ideally in federal or otherwise regulated environments.\n Required certifications: CFIA and CFIH.\nDemonstrated expertise with industry-standard forensic and analysis tools (e.g., EnCase, FTK, Autopsy/The Sleuth Kit, X-Ways, Volatility, Wireshark, YARA, and malware reverse-engineering tools such as Ghidra or IDA Pro).\nStrong command of Windows, Unix, and Linux internals; file systems (NTFS, FAT, EXT); virtualization; and SIEM/event-correlation platforms.\nWorking knowledge of the NICE Framework, NIST guidance, MITRE ATT&CK, chain-of-custody standards, and Rules of Evidence.\nExcellent technical writing and the ability to present findings clearly to legal, oversight, and investigative authorities.","description_format":"text","description_chars":5729,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Digital Government","Managed Security","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-09-16T22:18:03Z"}],"visa":[],"liveness":{"score":13,"band":"cold","label":"Long shot","p_open":1,"p_active":0.458,"p_room":0.28,"age_days":104,"expected_fill_days":41,"reasons":["conf:0","stale_co","urgency","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/agiledefense-digital-forensics-and-incident-analyst-ts","json_url":"https://alion.io/job/agiledefense-digital-forensics-and-incident-analyst-ts.json","meta":{"generated_at":"2026-10-30T22:57:17Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13988,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":716156},"rest":"https://alion.io/mcp/rest/get_company?id=716156"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fagiledefense-digital-forensics-and-incident-analyst-ts"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fagiledefense-digital-forensics-and-incident-analyst-ts"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fagiledefense-digital-forensics-and-incident-analyst-ts"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/agiledefense-digital-forensics-and-incident-analyst-ts\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fagiledefense-digital-forensics-and-incident-analyst-ts"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":983001}},{"tool":"search_jobs","arguments":{"company":"agiledefense.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":983001},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}