Digital Forensics and Incident Analyst

Agile Defense

Digital Forensics & Incident Analyst analyzing digital evidence and investigating computer security incidents. Supporting enterprise security operations and providing Tier 2 and Tier 3 SOC support.

Posted 7/18/2026full-timeWashington, D.C. • Washington • 🇺🇸 United StatesSeniorLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in digital forensics and incident response, utilizing industry-standard tools and methodologies to analyze and investigate cyber incidents. Proficient in technical writing and presenting findings to various stakeholders, ensuring compliance with legal and regulatory standards.

Highest-signal resume keywords

Digital ForensicsIncident ResponseTechnical WritingCybersecurity CertificationsSecurity Clearance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital Evidence AnalysisIntrusion AnalysisLog File AnalysisDynamic AnalysisMalware Reverse-Engineering

Soft Skills

Clear CommunicationAnalytical Thinking

Tools & Technologies

EnCaseFTKAutopsyX-WaysWiresharkGhidraIDA Pro

Certifications & Qualifications

CFIACFIH

Industry Keywords

NIST GuidanceMITRE ATT&CKNICE FrameworkChain-of-Custody StandardsRules of Evidence

Tech Stack

Tools & technologies

Cyber SecurityLinuxTypeScriptUnix

About the role

Key responsibilities & impact

Support the Threat Analysis & Investigations (TA&I) function, analyzing digital evidence and investigating computer security incidents
Provide Tier 2 and Tier 3 support to the enterprise Security Operations Center (SOC) and coordinate with partner/enterprise security operations centers
Identify, collect, examine, and preserve digital evidence using controlled and documented analytical and investigative techniques
Conduct digital analysis in response to investigations of computer-based crimes and cyber-intrusion incidents
Analyze log files, evidence, and other information to determine the best methods for identifying the perpetrator(s) of a network intrusion
Confirm what is known about an intrusion and discover new information via dynamic analysis
Provide technical summaries of findings and deliver written analysis reports
Collect and analyze intrusion artifacts and recommend courses of action or countermeasures to mitigate risk

Requirements

What you’ll need

U.S. citizenship and an active Top Secret (TS) security clearance
Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Systems, or a related field (additional experience may substitute for degree)
7 years of hands-on digital forensics and incident response (DFIR) experience, ideally in federal or otherwise regulated environments
Required certifications: CFIA and CFIH
Demonstrated expertise with industry-standard forensic and analysis tools (e.g., EnCase, FTK, Autopsy/The Sleuth Kit, X-Ways, Volatility, Wireshark, YARA, and malware reverse-engineering tools such as Ghidra or IDA Pro)
Strong command of Windows, Unix, and Linux internals; file systems (NTFS, FAT, EXT); virtualization; and SIEM/event-correlation platforms
Working knowledge of the NICE Framework, NIST guidance, MITRE ATT&CK, chain-of-custody standards, and Rules of Evidence
Excellent technical writing and the ability to present findings clearly to legal, oversight, and investigative authorities

Benefits

Comp & perks

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities