11 years of Cyber Security experience, including 2+ years in forensics or incident response.
Hands-on proficiency with forensic tools like Axiom, FTK, and EnCase.
Experience analyzing host artifacts and network packet captures.
Strong communication skills for translating technical details to non-technical audiences.
DoD 8570 IAT Level II compliant (e.g., Sec+, CISSP, CySA).
Preferred: Bachelor's degree in a related IT discipline.
Responsibilities
Perform live memory analysis and disk imaging while maintaining chain-of-custody protocols.
Analyze endpoint and cloud log data to map threat actor movements and build incident timelines.
Communicate with customers to coordinate threat containment and eradication strategies.
Conduct proactive and reactive threat hunting to uncover advanced persistent threats.
Prepare detailed forensic reports and root-cause analyses for incident response.
Advise customers on technical impacts and emerging threat trends.
Collaborate with cyber defense teams to deploy tactical updates and countermeasures post-incident.
Identify gaps in logging and visibility architectures, providing actionable recommendations.
Benefits
Opportunities for advancement within innovative projects.
Work-life balance with a Monday to Friday schedule.
Engagement in national security initiatives.
Full Job Description
Overview
The Digital Forensics & Incident Response (DFIR) Analyst leads the detection, containment, and forensic investigation of complex cybersecurity incidents within the organization. This professional acts as a core responder to active threats, securing volatile evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify root causes. The DFIR Analyst bridges technical forensics with risk mitigation, translating complex indicators of compromise into tactical response actions and enterprise countermeasures. At ManTech, you will help protect our national security while working on innovative projects that offer opportunities for advancement. Your role will be Monday - Friday with Core hours based in Herndon, VA.
What will you do?
Performs live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints while maintaining strict chain-of-custody protocols
Analyzes endpoint, cloud, and system log data to map threat actor movement, build comprehensive incident timelines, and isolate indicators of compromise (IOCs)
Communicates with the customer and affected end users to coordinate immediate threat containment and eradication strategies
Conducts proactive and reactive threat hunting across the network to uncover advanced persistent threats (APTs) and hidden persistence mechanisms
Prepares detailed technical forensic reports and root-cause analyses to justify Incident Response remediation, recovery plans, and network modifications
Advises the customer on technical impacts, zero-day vulnerabilities, and threat trends affecting organizational equities
Collaborates with cyber defense teams to deploy tactical signature updates, endpoint rules, and enterprise-wide countermeasures post-incident
Identifies gaps in current logging, visibility, and logging architectures, providing actionable engineering recommendations to mature continuous monitoring capabilities
Do you have what it takes?
Basic Qualifications:
Must have a Top Secret/SCI with Polygraph.
11 years of experience in Cyber Security with Government programs, with 2+ years of dedicated experience in host/network forensics, threat hunting, or Tier 3 incident response
2+ Hands-on proficiency with commercial and open-source forensic suites (e.g., Axiom, X-Ways, FTK, EnCase, Volatility, or KAPE) and Enterprise Detection & Response (EDR/XDR) platforms
2+ Direct experience analyzing host artifacts (MFT, Registry, Event Logs), volatile memory, and network packet captures (PCAP) to reconstruct cyber attacks
Strong written and verbal communications skills to effectively translate deep technical analysis into brief summaries for non-technical stakeholders
DoD 8570 IAT Level II Compliant (such as Sec+, CISSP, CySA, CCNA, GSEC, SSCP)
Preferred:
BS (bachelor's degree in digital forensics, cybersecurity, computer engineering, computer science, or other closely related IT discipline)
SANS or CYSA certifications
Pay Range: VTG's estimated starting pay range is $130,000-$240,000 annually, which is a general guideline for the geographic location. When extending an offer, VTG also considers work experience, education, skill level, market considerations and may possibly include contractual requirements which may cause an offer to fall outside of this range.
