New 
Security - Forensics/Malware Analyst
 Quadrant, Inc. | |
 United States, D.C., Washington | |
 Jan 30, 2025 | |
|
Forensics/Malware Analyst
Washington, DC Pay From: $45.00 per hour MUST: Experienced Forensics/Malware Analyst Must have one of the following certifications: GCIA, GCIH, GMON, GDAT, Splunk Core Power User Priority if you have one of the following certs: SANS, GCFA cert, EnCase Certified Examiner cert or Volatility 5 years of experience performing incident response activities for cloud-based and non-cloud-based environments, such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Zscaler 5 years of experience analyzing forensic artifacts, performing filesystem timeline analyses, and identifying intrusion root causes of operating systems (e.g., Windows, Linux, and macOS) 5 years of experience collecting and analyzing data from compromised systems using EDR agents (e.g. CrowdStrike) and custom scripts 5 years of experience utilizing the following forensics tools: Splunk to perform live forensic analysis; Magnet AXIOM to acquire, analyze, and report on digital evidence; Volatility framework to analyze volatile memory (RAM) dumps; Must have ability to perform required forensics/malware analyst duties, including: Create duplicates of evidence that ensure the original evidence is not unintentionally modified; Extracting deleted data using data carving techniques Performing static and dynamic malware analysis to discover indicators of compromise (IOCs) Bachelors degree preferred DUTIES: Provides digital forensics and incident response support to the Security Operations Center (SOC). Collects, analyzes, and evaluates forensic artifacts associated with threat activity against Judiciary networks. Products created by the analyst assist the SOC and the Courts in understanding the nature and impact of cyber incidents, allowing for informed decision making in prioritizing, addressing, and mitigating risk across the Judicial Branch of Government. Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now) for advanced subject matter expert (SME) technical investigative support for real-time incident response (IR). IR includes cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (e.g., Zscaler). Create duplicates of evidence that ensure the original evidence is not unintentionally modified. AOUSC supplied procedures and tools shall be used to acquire the evidence. Analyze forensic artifacts of operating systems (e.g., Windows, Linux, and macOS) to discover elements of an intrusion and identify root cause. Perform live forensic analysis based on SIEM data (e.g., Splunk). Perform filesystem timeline analysis for inclusion in forensic report. Extract deleted data using data carving techniques. Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC. Perform static and dynamic malware analysis to discover indicators of compromise (IOC). Analyze memory images to identify malicious patterns using Judiciary tools (e.g. Volatility). Analysis results documented in forensics report. Additional forensics/malware analysis activities may include: Perform efficient and prioritized identification of cyber security threats and incidents with an emphasis on clear articulation of the potential threat(s) and actualized risks associated with such threats and incidents. Objectively measure reduction of adversary dwell time within judicial networks. Perform comprehensive analysis of security incidents for identification of root cause in support of detection improvements and risk mitigations. Quadrant is an affirmative action/equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, status as a protected veteran, or status as an individual with a disability. | |