Network Forensics Analyst (Cybersecurity)

Location: Arlington, VA; onsite and remote incident-response engagements may be required.

Company

hirify.global is a small business providing IT, cybersecurity, information assurance, SOA, big data management, and program management services to federal, state, and local agencies.

What you will do

• Serve as a hunt and incident-response SME for network-centric and edge-device compromises.
• Analyze PCAP, flow records, DNS and proxy logs, device logs, configurations, and telemetry to identify, scope, and reconstruct intrusions.
• Reconstruct attack timelines, attacker paths, data-exfiltration patterns, and network trust-boundary issues.
• Evaluate and integrate new network-forensic and monitoring capabilities, and advise on network segmentation, firewall rules, IPS signatures, ACLs, and device hardening.
• Support preliminary investigations, containment, eradication, evidence preservation, customer communication, and technical direction for complex incidents.
• Produce executive summaries, technical reports, CND guidance, incident procedures, and standardized knowledge-base documentation.

Requirements

• U.S. Citizenship, active TS/SCI clearance, and ability to obtain DHS Suitability.
• 8+ years of directly relevant experience, including 3+ years evaluating and implementing new cyber-response or network-forensic capabilities.
• Hands-on incident-response or network-operations experience with enterprise edge devices from at least two of Cisco, Ivanti, Palo Alto, Ciena, and Juniper.
• Strong knowledge of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of CND policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to analyze network traffic and metadata, reconstruct malicious activity from traffic and device logs, identify attack stages, and translate findings into actionable recommendations.
• Understanding of system and application threats, vulnerabilities, proactive network analysis, trust levels, and anomalous behavior.
• Proficiency with Linux/Unix and Windows, plus operational cyber incident response covering scoping, containment, eradication, and recovery.
• Ability to work independently under pressure, collaborate across distributed teams, communicate with technical and non-technical stakeholders, and configure network TAPs, packet brokers, SPAN ports, and managed or unmanaged switches without disrupting live or air-gapped traffic.
• BS in Computer Science, Cyber Security, Computer Engineering, or a related field; alternatively, a high school diploma with 10+ years of technical experience in the area of expertise.

Nice to have

• Experience leading or mentoring incident-response, network-operations, or security-engineering teams and administering large or complex enterprise or service-provider environments.
• Knowledge of adversarial TTPs, MITRE ATT&CK, defense in depth, zero trust, network-device integrity, and enterprise security architecture.
• Experience with intrusion detection, event correlation, SIEM, beaconing, C2, data-exfiltration detection, IAM, vulnerability scanning, protocol parsers, and line-rate packet capture.
• Field diagnostics experience and ability to transport ruggedized analysis equipment within standard weight and air-transport limits.
• One or more of IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH, GNFA, GRID, GICSP, GCIP, CCNA/CCNP, PCNSE, JNCIS/JNCIP, or equivalent vendor certifications.

Culture & Benefits

• Work supports DHS HIRT missions for government agencies and critical-infrastructure owners.
• 95% employer-paid employee medical, dental, and vision coverage.
• Employer-paid life, short-term disability, and long-term disability coverage.
• 401(k) with company match and flexible spending accounts for dependent and healthcare expenses.
• 11 standard holidays and three weeks of annual leave.