Cyber Defense Forensics Specialist

Who you'll be:

We are seeking a Senior Forensics Specialist to join our Cyber Defense Forensics (CDF) team, supporting a federal agency's security operations center. As a subject-matter expert, you will lead the most technically demanding forensic investigations, mentor junior and mid-level analysts, and integrate forensic findings with counterintelligence and law-enforcement investigations. This role involves significant technical latitude and requires representation of the team's forensic capabilities in cross-functional discussions, executive briefings, and sensitive investigative matters.

What you'll do:

• Lead complex digital media forensic analysis, static malware code disassembly, and runtime malware code analysis for high-priority investigations.
• Provide guidance and mentorship to junior and mid-level forensic analysts, ensuring technical accuracy and defensibility in their work.
• Analyze and integrate forensic findings with other relevant data sources across the SOC, including threat intelligence and incident response data.
• Serve as the CDF team's subject-matter expert for evidence preservation, chain of custody, and legal-defensibility standards across all classification levels.
• Support the escalation of cases to law enforcement entities, including internal investigations, internal affairs, and the office of inspector general.
• Author and refine forensic Malware Analysis Reports for the most complex and high-visibility cases.
• Identify workflow optimization opportunities to increase case throughput without compromising forensic integrity.
• Represent the forensics function in cross-team incident response coordination and executive-level briefings as needed.

What you need:

• 10+ years of experience, BS degree (or 4 additional years as a substitute), MS degree (or 2 additional years as a substitute).
• A minimum of seven (7) years of professional experience in incident detection and response, malware analysis, or cyber forensics (or a bachelor's degree plus five (5) years).
• A minimum of five (5) years of professional experience performing digital media forensic analysis, static malware code disassembly/analysis, and/or runtime malware code analysis.
• Extensive experience analyzing and synthesizing information with other data sources, and integrating computer network attack analyses with counterintelligence and law-enforcement investigations.

Nice to have:

• Deep expertise in reverse engineering and malware behavioral analysis.
• Experience serving as an expert witness or providing sworn testimony related to digital evidence.
• Track record of building or maturing a forensics program, lab, or toolset at scale.

Required Certifications:

• One or more: CASP+, CISSP, CISA, GCIH, GCED.