{"id":3702109,"url":"https://alion.io/job/bcmc-terms-network-forensics-analyst-bcmc","title":"Network Forensics Analyst - BCMC","company":{"id":4418923,"name":"BCMC Terms","domain":"bcmcgroup.com","url":"https://alion.io/company/bcmcgroup","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"JazzHR","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Arlington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Defense in Depth","optional":false},{"name":"DNS","optional":false},{"name":"Windows","optional":false},{"name":"DNP3","optional":true},{"name":"IAM","optional":true},{"name":"ISO 27001","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"OPC UA","optional":true},{"name":"SIEM","optional":true},{"name":"Zero Trust","optional":true}],"status":"live","first_seen_at":"2026-11-03T19:51:38Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-05T18:31:58Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"The DHS Hunt and Incident Response Team (HIRT) secures the nation’s infrastructure. HIRT provides DHS’s front-line response for cyber incidents and proactive hunting for malicious cyber activity. Nightwing provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. Nightwing delivers HIRT advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.\nNightwing is seeking a Network Forensics Analyst with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.\nResponsibilities:\nServes as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.\nServes as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.\nAssists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.\nAssists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.\nCharacterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.\nIdentifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.\nReconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.\nExamines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.\nAssesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.\nDetermines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.\nApplies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.\nApplies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.\nLeads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.\nProvides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.\nServes as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.\nExercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.\nAnalyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.\nAdvises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).\nSupports internal stakeholders on containment and eradication missions, on-site and remotely.\nEnsures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.\nAssists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.\nDistills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.\nDocuments analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.\nAssists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.\nRequired Skills:\nU.S. Citizenship.\nActive TS/SCI clearance.\nAbility to obtain DHS Suitability.\n8+ years of directly relevant experience\n3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.\nHands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.\nStrong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.\nKnowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.\nAbility to:\no Characterize and analyze network traffic to identify anomalous activity and potential threats.\no Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.).\no Reconstruct malicious activity based on network traffic and device logs.\nUnderstanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.\nUnderstanding of system and application security threats and vulnerabilities and how they are observed in network traffic.\nUnderstanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.\nProficiency with common operating systems (e.g., Linux/Unix, Windows).\nExperience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.\nAbility to think independently, make sound decisions under pressure, and work with limited guidance.\nSuperior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.\nAbility to work collaboratively across physical locations and within distributed teams.\nSkilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.\nRapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air-gapped traffic.\nDesired Skills:\nExperience leading and mentoring technical teams in incident response, network operations, or security engineering.\nNetwork and system administration experience in large or complex enterprise or service-provider environments.\nStrong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non nation state adversaries, nation state actors).\nKnowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures.\nKnowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, malicious code).\nKnowledge of network device integrity verification and monitoring approaches.\nHands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM).\nExperience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection.\nExperience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures.\nAbility to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture-level improvements.\nAbility to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership).\nField Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate.\nCompact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry-on/air-transport limits.\nRequired Education:\nBS in Computer Science, Cyber Security, Computer Engineering, or related degree;\nOR HS Diploma and 10+ years of technical experience in the area of expertise.\nDesired Certifications (One or more):\nIASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder,CEH,\nSANS GIAC GCIA or GNFA (preferred for network forensics).\nSANS GRID, GICSP, or GCIP (plus).\nVendor / network certifications (highly desired):\no Cisco CCNA (or higher: CCNP Security, CCNP Enterprise).\no Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.).\nOur Company Overview\nBusiness Computers Management Consulting Group, LLC (BCMC) is a small business specializing in Information Technology (IT), Cybersecurity, Information Assurance (IA), SOA, Big Data Management, Program Management, and more for Federal, State, and Local agencies. We possess highly skilled engineers, providing innovative solutions backed by strong past performances. We are ISO 9001:2015, ISO 27001:2013, 20000:2018, and CMMI L3 certified and registered promising highest quality and services to all of our clients.\nBenefits\nExtremely competitive salary\n95% employer paid for employee medical, dental, & vision coverages\n100% employer paid for employee life, STD & LTD disability coverages\n401k with company match\nFlexible Spending Account (FSA) for dependent & health care\n11 standard holidays & 3 weeks of annual leave\nNBA04\nNetwork Based Systems Analyst - IV\nESS-3691\nESS-3692","description_format":"text","description_chars":10266,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["401k plan","Annual leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Professional Services","National Security","Incident Response","Management Consulting"],"lifecycle":[{"event":"open","at":"2026-11-03T19:51:38Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":9,"reasons":["conf:5","velocity","win:early"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/bcmc-terms-network-forensics-analyst-bcmc","json_url":"https://alion.io/job/bcmc-terms-network-forensics-analyst-bcmc.json","meta":{"generated_at":"2026-11-05T23:03:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4096,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4418923},"rest":"https://alion.io/mcp/rest/get_company?id=4418923"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbcmc-terms-network-forensics-analyst-bcmc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbcmc-terms-network-forensics-analyst-bcmc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbcmc-terms-network-forensics-analyst-bcmc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bcmc-terms-network-forensics-analyst-bcmc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbcmc-terms-network-forensics-analyst-bcmc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3702109}},{"tool":"search_jobs","arguments":{"company":"bcmcgroup.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3702109},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}