Accountabilities:

Conduct rapid cybersecurity incident triage, forensic investigations, and security assessments to identify exploitation attempts, unauthorized access, and potential system compromises.
Investigate vulnerabilities identified in the CISA Known Exploited Vulnerabilities (KEV) Catalog and evaluate potential exploitation across enterprise IT environments.
Analyze endpoint, network, application, authentication, SIEM, EDR, vulnerability scanning, and cloud audit logs to detect suspicious activities and identify indicators of compromise (IOCs).
Perform digital forensic investigations to uncover persistence mechanisms, privilege escalation, lateral movement, command-and-control communications, and potential data exposure.
Collect, preserve, examine, and document digital evidence in accordance with NIST SP 800-86 and established forensic evidence-handling practices.
Develop incident response strategies and recommend appropriate containment, eradication, recovery, and risk mitigation measures.
Collaborate with cybersecurity teams, system administrators, cloud engineers, and other stakeholders to investigate, manage, and resolve security incidents.
Escalate confirmed or suspected security compromises and provide clear, actionable technical recommendations.
Prepare comprehensive forensic investigation reports, incident timelines, technical findings, executive summaries, and remediation recommendations.
Support time-sensitive incident response operations, including initial incident acknowledgment, forensic triage, daily progress updates, and incident closure documentation.
Maintain accurate investigation records, evidence inventories, chain-of-custody documentation, and supporting technical artifacts.
Ensure all incident response and forensic activities comply with applicable federal cybersecurity requirements, NIST guidelines, and organizational security policies.

Requirements

Minimum of 8 years of professional experience in cybersecurity, information security, or a related technical discipline.
At least 5 years of hands-on experience in cybersecurity incident response, digital forensics, or security investigations.
Demonstrated experience investigating cybersecurity incidents within enterprise or federal IT environments.
Strong understanding of vulnerability exploitation, incident response methodologies, and digital forensic investigation processes.
Proven experience analyzing SIEM, EDR, endpoint, network, and cloud security logs.
Working knowledge of Windows and Linux operating systems, security architectures, and common cyberattack techniques.
Familiarity with the CISA Known Exploited Vulnerabilities (KEV) Catalog, NIST SP 800-61, NIST SP 800-86, and federal cybersecurity practices.
Experience preserving digital evidence and producing accurate, technically defensible forensic investigation reports.
Strong analytical, troubleshooting, problem-solving, and technical documentation skills.
Excellent written and verbal communication skills, with the ability to explain complex technical findings to different audiences.
Ability to manage urgent cybersecurity incidents, prioritize competing demands, and work effectively within accelerated investigation timelines.
US citizenship is mandatory for this position.
A Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related discipline is required, or equivalent professional experience.
Relevant professional certifications are required. At least one of the following credentials must be held:
GIAC Certified Incident Handler (GCIH).
GIAC Certified Forensic Analyst (GCFA).
GIAC Certified Forensic Examiner (GCFE).
GIAC Cloud Forensics Responder (GCFR).

Preferred Qualifications

Previous experience supporting federal agencies or government cybersecurity programs.
Knowledge of NIST SP 800-53, FISMA, FedRAMP, and Risk Management Framework (RMF) requirements.
Hands-on experience with forensic tools and techniques for endpoint, network, and cloud investigations.
Familiarity with SIEM platforms such as Splunk and Microsoft Sentinel.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1