Digital Forensics Analyst

MANTECH seeks a motivated, career- and customer-oriented Digital Forensics Analyst to join our team in Herndon, VA. In this role, you will lead the detection, containment, and forensic investigation of complex cybersecurity incidents within the organization. Acting as a core responder to active threats, you will secure volatile evidence, analyze host and network telemetry, and reconstruct attack timelines to identify root causes, bridging technical forensics with risk mitigation by translating complex indicators of compromise into tactical response actions and enterprise countermeasures.

Responsibilities include, but are not limited to:

• Perform live memory analysis, disk imaging, and forensic data acquisition across enterprise and cloud endpoints while maintaining strict chain-of-custody protocols.
• Analyze endpoint, cloud, and system log data to map threat actor movement, build comprehensive incident timelines, and isolate indicators of compromise (IOCs).
• Communicate with the customer and affected end users to coordinate immediate threat containment and eradication strategies.
• Conduct proactive and reactive threat hunting across the network to uncover advanced persistent threats (APTs) and hidden persistence mechanisms.
• Prepare detailed technical forensic reports and root-cause analyses to justify Incident Response remediation, recovery plans, and network modifications.
• Collaborate with cyber defense teams to deploy tactical signature updates, endpoint rules, and enterprise-wide countermeasures post-incident.
• Identify gaps in current logging, visibility, and logging architectures, providing actionable engineering recommendations to mature continuous monitoring capabilities.
• Advise the customer on technical impacts, zero-day vulnerabilities, and threat trends affecting organizational equities.

Minimum Qualifications:

• 7+ years of experience in Cybersecurity
• 2+ years of experience in host/network forensics, threat hunting, or Tier 3 cybersecurity incident response
• 2+ years of experience with commercial and open-source forensic suites (e.g., Magnet AXIOM, X-Ways, FTK, EnCase, Volatility, or KAPE) and Enterprise Detection & Response (EDR/XDR) platforms
• 2+ years of experience analyzing host artifacts (e.g., MFT, Registry, Event Logs), volatile memory, and network packet captures (PCAP) to reconstruct cyber attacks
• Must possess an active DoD 8570 IAT Level II (or higher) certification (CompTIA Security+, SSCP, CySA+, GSEC, GICSP, CCNA Security, CND v3, RHCSA, CISSP (or Associate), CISA, CompTIA Advanced Security Practitioner/SecurityX, CCNP Security, CCSP, GCIH, or GCED)

Preferred Qualifications:

• Bachelor’s degree in Digital Forensics, Cybersecurity, Computer Engineering, Computer Science, or a closely related IT discipline.

Security Clearance Requirements:

• Must have a current/active TS/SCI clearance with Polygraph.

Physical Requirements:

• Must be able to remain in a stationary position 50% of the time.