11+ years of cybersecurity experience, including 2+ years in host/network forensics or Tier 3 incident response.
Proficient with digital forensic tools like Magnet AXIOM, FTK, and EnCase.
Experience with Enterprise Detection and Response (EDR/XDR) platforms.
Skilled in analyzing host-based artifacts and network packet captures.
Strong ability to reconstruct cyber attacks and identify indicators of compromise.
Excellent communication skills for translating technical findings into reports.
DoD 8570 IAT Level II certification or higher.
Responsibilities
Conduct advanced digital forensic investigations while maintaining chain-of-custody procedures.
Analyze endpoint artifacts and network data to identify indicators of compromise and reconstruct attack timelines.
Coordinate with customer personnel for immediate threat containment and recovery strategies.
Perform proactive threat hunting to identify advanced persistent threats and malicious activities.
Conduct root-cause analyses and develop technical forensic reports for incident remediation.
Advise leadership on cybersecurity risks and emerging threats.
Collaborate with teams to develop tactical updates and security countermeasures.
Identify deficiencies in monitoring architectures and provide actionable recommendations.
Benefits
Opportunity to work on mission-critical national security projects.
Collaborative environment with direct customer interaction.
Access to advanced tools and technologies in cybersecurity.
Professional development opportunities in incident response and digital forensics.
Full Job Description
Job Description
WarCollar Industries has an immediate opportunity for an experienced Digital Forensics & Incident Response (DFIR) Specialist to support a mission-critical national security customer in Herndon, VA. The DFIR Specialist will lead the detection, containment, and forensic investigation of complex cybersecurity incidents across enterprise and cloud environments.
This role will serve as a senior technical responder responsible for investigating active cyber threats, acquiring and preserving digital evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify threat actor activity and root causes. The ideal candidate will bring extensive hands-on experience in digital forensics, incident response, and advanced threat hunting, along with the ability to translate complex forensic findings into actionable remediation strategies and enterprise-wide security improvements.
Key Responsibilities
Conduct advanced digital forensic investigations, including live memory analysis, disk imaging, and forensic data acquisition across enterprise systems and cloud-based endpoints while maintaining strict chain-of-custody procedures.
Analyze endpoint artifacts, cloud telemetry, system logs, and network data to identify indicators of compromise (IOCs), reconstruct attack timelines, and determine threat actor tactics, techniques, and procedures (TTPs).
Coordinate directly with customer personnel and affected end users to implement immediate threat containment, eradication, and recovery strategies.
Perform proactive and reactive threat hunting across enterprise networks to identify advanced persistent threats (APTs), malicious activity, and hidden persistence mechanisms.
Conduct detailed root-cause analyses and develop comprehensive technical forensic reports to support incident remediation, recovery planning, and recommended network modifications.
Advise customer leadership and technical stakeholders on cybersecurity risks, technical impacts, zero-day vulnerabilities, emerging threats, and potential impacts to organizational equities.
Collaborate with cyber defense and engineering teams to develop and deploy tactical signature updates, endpoint detection rules, and enterprise-wide security countermeasures following security incidents.
Identify deficiencies in existing logging, monitoring, and network visibility architectures, providing actionable recommendations to strengthen continuous monitoring and incident detection capabilities.
Support the development and refinement of incident response procedures, forensic methodologies, and technical security controls to improve organizational cyber defense capabilities.
Required Skills
Minimum of 11 years of cybersecurity experience supporting Government programs, including at least 2 years of dedicated experience in host/network forensics, advanced threat hunting, or Tier 3 incident response.
Hands-on experience with commercial and open-source digital forensic tools and platforms, such as Magnet AXIOM, X-Ways Forensics, FTK, EnCase, Volatility, or KAPE.
Experience utilizing Enterprise Detection and Response (EDR/XDR) platforms to investigate, analyze, and respond to advanced cyber threats.
Demonstrated experience analyzing host-based artifacts, including Master File Table (MFT), Windows Registry, system event logs, volatile memory, and network packet captures (PCAP).
Ability to reconstruct complex cyber attacks, identify indicators of compromise, and determine root causes through detailed forensic analysis.
Strong understanding of incident response methodologies, threat actor behaviors, network security, and advanced persistent threats.
Excellent written and verbal communication skills, with the ability to translate complex technical findings into concise reports and executive-level briefings.
DoD 8570 IAT Level II certification compliance or higher.
Desired Skills
Bachelor's degree in Digital Forensics, Cybersecurity, Computer Engineering, Computer Science, Information Technology, or a closely related discipline.
SANS certifications or CompTIA Cybersecurity Analyst (CySA+) certification.
Experience supporting advanced cyber defense operations within the Intelligence Community or Department of Defense.
Familiarity with cloud forensics, enterprise endpoint security, advanced threat detection, and forensic evidence preservation.
Experience developing technical recommendations to improve enterprise security architecture, logging capabilities, and continuous monitoring operations.
