Overview
The Digital Forensics & Incident Response (DFIR) Analyst leads the detection, containment, and forensic investigation of complex cybersecurity incidents within the organization. This professional acts as a core responder to active threats, securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes. The DFIR Analyst bridges technical forensics with risk mitigation, translating complex indicators of compromise into tactical response actions and enterprise countermeasures. At ManTech, you will help protect our national security while working on innovative projects that offer opportunities for advancement. Your role will be Monday - Friday with Core hours based in Herndon, VA.
What will you do?
- Performs live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints while maintaining strict chain-of-custody protocols
- Analyzes endpoint, cloud, and system log data to map threat actor movement, build comprehensive incident timelines, and isolate indicators of compromise (IOCs)
- Communicates with the customer and affected end users to coordinate immediate threat containment and eradication strategies
- Conducts proactive and reactive threat hunting across the network to uncover advanced persistent threats (APTs) and hidden persistence mechanisms
- Prepares detailed technical forensic reports and root-cause analyses to justify Incident Response remediation, recovery plans, and network modifications
- Advises the customer on technical impacts, zero-day vulnerabilities, and threat trends affecting organizational equities
- Collaborates with cyber defense teams to deploy tactical signature updates, endpoint rules, and enterprise-wide countermeasures post-incident
- Identifies gaps in current logging, visibility, and logging architectures, providing actionable engineering recommendations to mature continuous monitoring capabilities
Do you have what it takes?
Basic Qualifications:
- Must have a Top Secret/SCI with Polygraph.
-
11 years of experience in Cyber Security with Government programs, with 2+ years of dedicated experience in host/network forensics, threat hunting, or Tier 3 incident response
- 2+ Hands-on proficiency with commercial and open-source forensic suites (e.g., Axiom, X-Ways, FTK, EnCase, Volatility, or KAPE) and Enterprise Detection & Response (EDR/XDR) platforms
- 2+ Direct experience analyzing host artifacts (MFT, Registry, Event Logs), volatile memory, and network packet captures (PCAP) to reconstruct cyber attacks
-
Strong written and verbal communications skills to effectively translate deep technical analysis into brief summaries for non-technical stakeholders -
DoD 8570 IAT Level II Compliant (such as Sec+, CISSP, CySA, CCNA, GSEC, SSCP)
Preferred:
- BS (bachelor's degree in digital forensics, cybersecurity, computer engineering, computer science, or other closely related IT discipline)
- SANS or CYSA certifications
PayRange: VTG's estimated starting pay range is $130,000-$240,000 annually, which is a general guideline for the geographic location. When extending an offer, VTG also considers work experience, education, skill level, market considerations and may possibly include contractual requirements which may cause an offer to fall outside of this range.
|
VTG Defense
$130000.00-$240000.00
Nov 13, 2026