Digital Forensic Analyst

• Serve as the forensics subject matter expert within the incident response team, providing timely and expert forensic support across all phases of the incident response lifecycle, from initial detection and containment through eradication, recovery, and post-incident review.
• Respond to cybersecurity incidents requiring forensic investigation, deploying forensic capabilities rapidly to collect and preserve volatile and non-volatile evidence before it is lost or altered.
• Conduct forensic triage of affected systems and environments to rapidly characterize the scope, nature, and impact of security incidents, providing actionable intelligence to incident response and operations teams in support of containment and eradication decisions.
• Develop and maintain incident-specific forensic timelines, reconstructing the sequence of attacker or insider actions from available evidence to support root cause analysis, impact assessment, and lessons learned activities.
• Coordinate with the NOC, Security Operations Center (SOC), and other functional teams to ensure forensic activities are integrated effectively into the broader incident response process.
• Support post-incident review activities, providing forensic findings, timeline reconstructions, and evidentiary analysis to inform root cause determinations and corrective action recommendations.

• Establish, maintain, and enforce rigorous chain of custody procedures for all digital evidence collected, processed, and stored under the program, ensuring all evidence handling activities are documented in accordance with applicable legal and regulatory requirements.
• Maintain accurate and complete evidence logs, documenting the acquisition, transfer, storage, examination, and disposition of all digital evidence items throughout their lifecycle.
• Ensure all digital evidence is stored securely in accordance with applicable client policies, Federal regulations, and evidence handling best practices, protecting evidence integrity and preventing unauthorized access, alteration, or destruction.
• Support the preparation and organization of digital evidence for submission to law enforcement, legal counsel, or other authorized parties as directed by the Government.

• Prepare comprehensive, well-structured, and legally defensible forensic examination reports documenting examination scope, methodologies, tools used, findings, evidence items, and conclusions for each completed forensic investigation.
• Develop and maintain forensic case files, ensuring all examination notes, tool output, evidence logs, chain of custody records, and supporting documentation are organized, complete, and accessible throughout the investigation lifecycle.
• Present forensic findings clearly and effectively to diverse audiences, including program leadership, Government stakeholders, legal counsel, and, where required, law enforcement or investigative authorities, translating complex technical findings into clear, actionable narratives.
• Develop and maintain forensic process documentation, standard operating procedures, and examination templates to ensure consistency, repeatability, and quality across all forensic examination activities.
• Contribute forensic findings and indicators of compromise to the program's threat intelligence repository, supporting broader detection, prevention, and response capabilities.

• Maintain and administer the program's forensic tool suite, ensuring all forensic tools and platforms are properly licensed, configured, updated, and validated for operational use.
• Stay current with emerging digital forensics techniques, tools, threat actor tactics, techniques, and procedures (TTPs), and evolving evidentiary standards, incorporating new capabilities and methodologies into the program's forensic practice as appropriate.
• Develop and maintain custom scripts, queries, and analysis frameworks to enhance forensic examination efficiency, automate repetitive analysis tasks, and extend forensic coverage across diverse evidence types and platforms.
• Support the development and delivery of forensic awareness training and knowledge transfer activities for program personnel and Government stakeholders as directed.
• Evaluate and recommend new forensic tools, platforms, and capabilities to enhance the program's forensic examination capabilities in response to evolving threats and client requirements.

• Ensure all digital forensics activities are conducted in full compliance with applicable Federal statutes, regulations, and client policies, including FISMA, NIST SP 800-53, NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response), applicable privacy laws, and Federal Rules of Evidence requirements.
• Support compliance with applicable cybersecurity frameworks and requirements, including NIST SP 800-207 Zero Trust Architecture, OMB M-22-09, and client-specific cybersecurity policies.
• Ensure all forensic activities involving personally identifiable information (PII), protected health information (PHI), CUI, or other sensitive data categories are conducted in accordance with applicable privacy protection requirements and data handling restrictions.
• Support audit readiness activities by maintaining organized, complete, and accessible forensic case documentation and compliance evidence files.

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, Information Technology, Information Systems, or a related field from an accredited college or university. Equivalent combination of education and directly relevant experience may be considered.
• Minimum of 5 years of hands-on experience in digital forensics, cybersecurity incident response, or a closely related discipline within a federal government IT contracting or law enforcement environment.
• Demonstrated hands-on experience conducting forensic examinations of Windows and Linux-based systems, including disk forensics, memory forensics, log analysis, and forensic timeline reconstruction.
• Experience conducting forensic investigations in cloud environments, including Microsoft 365, Azure, or AWS.
• Experience maintaining chain of custody and producing legally defensible forensic examination reports suitable for submission to legal or law enforcement authorities.
• Active security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations. Specific clearance requirements will be confirmed at time of offer.

• Prior experience supporting digital forensics and incident response on a federal IT program of comparable scale and complexity.
• Experience conducting mobile device forensics, network forensics, and/or malware analysis in support of federal cybersecurity investigations.
• Experience supporting e-discovery and litigation hold activities in a federal government context.

• Exceptional analytical and critical thinking skills with demonstrated ability to conduct thorough, methodical, and well-documented forensic examinations across a diverse range of digital evidence types, platforms, and investigation scenarios.
• Deep technical proficiency with industry-standard digital forensics tools, including one or more of the following: Magnet AXIOM, EnCase, FTK (Forensic Toolkit), Cellebrite UFED, Volatility, Autopsy, X-Ways Forensics, or equivalent platforms.
• Strong proficiency in forensic acquisition techniques, including disk imaging, memory acquisition, network traffic capture, and cloud evidence collection, with demonstrated ability to ensure evidence integrity through proper hashing and write-blocking procedures.
• Demonstrated experience in Windows forensic artifact analysis, including NTFS file system forensics, Windows registry analysis, Windows event log analysis, prefetch and LNK file analysis, and browser artifact examination.
• Experience with Linux and/or macOS forensic artifact analysis, including file system forensics, log analysis, and user activity reconstruction.
• Proficiency in memory forensics, including volatile memory acquisition and analysis using tools such as Volatility or equivalent platforms.
• Experience with log analysis and correlation across diverse log sources, including Windows event logs, Sysmon, network device logs, web server logs, and cloud platform audit logs.
• Familiarity with malware analysis techniques, including static analysis (e.g., PE analysis, string extraction, YARA rule development) and dynamic analysis (e.g., sandbox execution and behavioral analysis).
• Experience with network forensics, including PCAP analysis using tools such as Wireshark or equivalent platforms, and network flow analysis for investigation support.
• Knowledge of cloud forensics techniques and evidence sources across Microsoft 365 (e.g., Unified Audit Log, Exchange Online, SharePoint, Teams), Azure, and/or AWS environments.
• Strong chain of custody documentation skills with demonstrated ability to maintain accurate and complete evidence logs and produce professionally formatted, legally defensible forensic examination reports.
• Excellent written and verbal communication skills with the demonstrated ability to present complex technical forensic findings clearly and accurately to diverse audiences including program leadership, Government stakeholders, and legal counsel.
• Familiarity with applicable Federal forensic and cybersecurity standards, including NIST SP 800-86, NIST SP 800-53, FISMA, and Federal Rules of Evidence requirements.
• Proficiency with scripting languages (e.g., Python, PowerShell, or Bash) for forensic automation, data parsing, and analysis workflow development.

• Certified Forensic Computer Examiner (CFCE), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Forensic Examiner (GCFE), EnCase Certified Examiner (EnCE), AccessData Certified Examiner (ACE), or equivalent industry-recognized digital forensics certification.
• GIAC Certified Incident Handler (GCIH), GIAC Certified Enterprise Defender (GCED), Certified Information Systems Security Professional (CISSP), or equivalent cybersecurity certification.
• GIAC Reverse Engineering Malware (GREM) certification or demonstrated equivalent malware analysis expertise.
• Cellebrite Certified Mobile Examiner (CCME) or equivalent mobile device forensics certification.
• Experience with Security Information and Event Management (SIEM) platforms (e.g., Splunk, Microsoft Sentinel, or equivalent) for log aggregation, query development, and investigation support.
• Experience with threat intelligence platforms and the practical application of threat intelligence to forensic investigation and indicator of compromise development.
• Familiarity with MITRE ATT&CK framework and its application to forensic investigation, attacker TTP identification, and incident reconstruction.
• Experience supporting insider threat investigations, including the forensic analysis of user activity, data exfiltration indicators, and behavioral anomalies.
• Experience with e-discovery platforms and electronically stored information (ESI) processing workflows in support of Federal litigation hold and legal matter requirements.
• Knowledge of Zero Trust Architecture principles (NIST SP 800-207, OMB M-22-09) and their practical application to forensic investigation and incident response within a federal enterprise IT environment.
• Experience with YARA rule development and application for malware identification and forensic artifact classification.
• Familiarity with Section 508 compliance requirements for digital tools and reporting products delivered under federal contracts.
• Experience developing and delivering forensic training, knowledge transfer sessions, or awareness materials for program personnel and Government stakeholders.

The company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race, color, religion, creed, ethnicity, sex, sexual orientation, gender or gender identity (except where gender is a bona fide occupational qualification), national origin or ancestry, age, disability, citizenship, military/veteran status, marital status, genetic information or any other characteristic protected by applicable federal, state, or local law. We are committed to equal employment opportunity in all decisions related to employment, promotion, wages, benefits, and all other privileges, terms, and conditions of employment.

The company is dedicated to seeking all qualified applicants.

If you require an accommodation to navigate or to apply to a position on our website, please contact Heaven Wood via e-mail at accommodations@koniag-gs.com or by calling 703-488-9377 to request accommodations.

Koniag Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions, Professional Services and Operational Management to Federal Government Agencies.

As a wholly owned subsidiary of Koniag, we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical, professional, and operational solutions.

KGS enables successful mission outcomes for our customers through solution-oriented business partnerships and a commitment to exceptional service delivery.

We ensure long-term success with a continuous improvement approach while balancing the collective interests of our customers, employees, and native communities.

For more information, please visit www.koniag-gs.com .

Equal Opportunity Employer/Veterans/Disabled.

Shareholder Preference in accordance with Public Law 88-352