cFocus Software Incorporated
Malware and Forensic Analyst (Senior)
cFocus Software Incorporated - Washington, District of Columbia, us, 20022
Work at cFocus Software Incorporated
Overview
- View job
Overview
1 month ago Be among the first 25 applicants
cFocus Software seeks a Malware and Forensic Analyst (Senior) to join our program supporting US Courts in Washington, DC.
Required Qualifications include:
5 years of experience analyzing forensic artifacts, performing filesystem timeline analyses, and identifying intrusion root causes of
operating systems (e.g.,
Windows, Linux, and macOS ) 5 years of experience utilizing the following forensics tools
:
Magnet AXIOM
to acquire, analyze, and report on digital evidence; SANS SIFT Workstation
for disk/memory analysis, network forensics, and malware analysis; Encase
to collect, analyze, and report on digital evidence; Velociraptor
to collect and analyze data from multiple endpoints; KAPE (Eric Zimmerman’s tools)
to collect and process files; SUMURI TALINO Workstations/Laptops Cellebrite Bi-Weekly Threat Assessment Reports (BTARs)
Must have ability to perform required forensics/malware analyst duties, including:
Create duplicates of evidence
that ensure the original evidence is not unintentionally modified; Extracting deleted data
using data carving techniques Performing static and dynamic malware analysis
to discover indicators of compromise (IOCs)
Must be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC Desired Qualifications include:
One of the following certifications:
GIAC Certified Intrusion Analyst (GCIA) GIAC Certified Incident Handler (GCIH) GIAC Continuous Monitoring (GMON) GIAC Defending Advanced Threats (GDAT) Splunk Core Power User EnCase Certified Examiner Sans GCFA Volatility Certified
Duties:
Provides digital forensics and incident response support to the AOUSC Security Operations Center (SOC). Collects, analyzes, and evaluates forensic artifacts associated with threat activity against Judiciary networks. Products created by the analyst assist the SOC and the Courts in understanding the nature and impact of cyber incidents, allowing for informed decision making in prioritizing, addressing, and mitigating risk across the Judicial Branch of Government. Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now) for advanced subject matter expert (SME) technical investigative support for real-time incident response (IR). IR includes cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (e.g., Zscaler). Create duplicates of evidence that ensure the original evidence is not unintentionally modified. AOUSC supplied procedures and tools shall be used to acquire the evidence. Analyze forensic artifacts of operating systems (e.g., Windows, Linux, and macOS) to discover elements of an intrusion and identify root cause. Perform live forensic analysis based on SIEM data (e.g., Splunk). Perform filesystem timeline analysis for inclusion in forensic report. Extract deleted data using data carving techniques. Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC. Perform static and dynamic malware analysis to discover indicators of compromise (IOC). Analyze memory images to identify malicious patterns using Judiciary tools (e.g. Volatility). Analysis results documented in forensics report. Additional forensics/malware analysis activities may include:
Perform efficient and prioritized identification of cyber security threats and incidents with an emphasis on clear articulation of the potential threat(s) and actualized risks associated with such threats and incidents. Objectively measure reduction of adversary dwell time within judicial networks. Perform comprehensive analysis of security incidents for identification of root cause in support of detection improvements and risk mitigations.
Deliverables:
Image Duplication:
Duplication of evidence for processing by multiple analysts. Requests received via AOUSC ITSM (Heat or Service Now) Deleted Files:
Deleted files supplied to requestor. Advanced SME IR Reports
: Timely Advanced SME IR Support for Priority 1 Security Events. SME actively participating in IR activities within 4 hours of request (7x24x365). Incident Reports
: All forensic reports include a timeline. The timeline includes network, endpoint, and application events (if available). The report contains all data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable section. Forensic Reports:
Document the results of a forensic investigation. Report will include a table of contents, executive summary, timeline of events, and a conclusion. Malware Analysis Reports:
Document the results of analyzing a specific malware specimen. Report shall include a table of contents, executive summary, technical details, indication of persistence mechanisms and a conclusion. Provide
Weekly Reports
to the AOUSC Program Manager that documents all activities, tasks, tickets and documents worked on. Document repeatable
Standard Operation Procedures (SOPs)
and playbooks for security use cases.
Seniority level
Seniority level Mid-Senior level Employment type
Employment type Full-time Job function
Job function Sales, General Business, and Education Industries Wireless Services, Telecommunications, and Communications Equipment Manufacturing Referrals increase your chances of interviewing at cFocus Software Incorporated by 2x Sign in to set job alerts for “Forensic Analyst” roles.
Gaithersburg, MD $115,000.00-$125,000.00 3 weeks ago Digital Forensics and Incident Response Team Lead
Senior Forensic Scientist (Crime Scene Unit), Grade 26
Gaithersburg, MD $84,694.00-$136,188.00 1 week ago (2026 Bachelor's/Master's graduates) Cyber & Forensic Technology Consulting Analyst/Associate
Washington, DC $91,000.00-$95,000.00 5 hours ago Bethesda, MD $135,000.00-$165,000.00 3 weeks ago Gaithersburg, MD $115,000.00-$125,000.00 3 weeks ago Host Forensic Analyst/Host Based Systems Analyst
Arlington, VA $66,000.00-$106,000.00 2 weeks ago Fort Meade, MD $95,000.00-$130,000.00 7 hours ago Digital Forensic Analyst (TS/SCI)- Senior & Mid
Washington, DC $110,000.00-$125,000.00 2 weeks ago Tier 3 Digital Forensics and Incident Response Analyst
Washington, DC $155,000.00-$165,000.00 1 week ago Senior Schedule Forensics and Delay Claims Analyst
Washington, DC $107,000.00-$120,500.00 6 days ago Gaithersburg, MD $115,000.00-$125,000.00 3 weeks ago Digital Forensics and Incident Response Analyst - Tier 3
Washington, DC $150,000.00-$165,000.00 1 week ago Arlington, VA $86,000.00-$138,000.00 1 week ago We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
#J-18808-Ljbffr
Required Qualifications include:
5 years of experience analyzing forensic artifacts, performing filesystem timeline analyses, and identifying intrusion root causes of
operating systems (e.g.,
Windows, Linux, and macOS ) 5 years of experience utilizing the following forensics tools
:
Magnet AXIOM
to acquire, analyze, and report on digital evidence; SANS SIFT Workstation
for disk/memory analysis, network forensics, and malware analysis; Encase
to collect, analyze, and report on digital evidence; Velociraptor
to collect and analyze data from multiple endpoints; KAPE (Eric Zimmerman’s tools)
to collect and process files; SUMURI TALINO Workstations/Laptops Cellebrite Bi-Weekly Threat Assessment Reports (BTARs)
Must have ability to perform required forensics/malware analyst duties, including:
Create duplicates of evidence
that ensure the original evidence is not unintentionally modified; Extracting deleted data
using data carving techniques Performing static and dynamic malware analysis
to discover indicators of compromise (IOCs)
Must be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC Desired Qualifications include:
One of the following certifications:
GIAC Certified Intrusion Analyst (GCIA) GIAC Certified Incident Handler (GCIH) GIAC Continuous Monitoring (GMON) GIAC Defending Advanced Threats (GDAT) Splunk Core Power User EnCase Certified Examiner Sans GCFA Volatility Certified
Duties:
Provides digital forensics and incident response support to the AOUSC Security Operations Center (SOC). Collects, analyzes, and evaluates forensic artifacts associated with threat activity against Judiciary networks. Products created by the analyst assist the SOC and the Courts in understanding the nature and impact of cyber incidents, allowing for informed decision making in prioritizing, addressing, and mitigating risk across the Judicial Branch of Government. Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now) for advanced subject matter expert (SME) technical investigative support for real-time incident response (IR). IR includes cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (e.g., Zscaler). Create duplicates of evidence that ensure the original evidence is not unintentionally modified. AOUSC supplied procedures and tools shall be used to acquire the evidence. Analyze forensic artifacts of operating systems (e.g., Windows, Linux, and macOS) to discover elements of an intrusion and identify root cause. Perform live forensic analysis based on SIEM data (e.g., Splunk). Perform filesystem timeline analysis for inclusion in forensic report. Extract deleted data using data carving techniques. Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC. Perform static and dynamic malware analysis to discover indicators of compromise (IOC). Analyze memory images to identify malicious patterns using Judiciary tools (e.g. Volatility). Analysis results documented in forensics report. Additional forensics/malware analysis activities may include:
Perform efficient and prioritized identification of cyber security threats and incidents with an emphasis on clear articulation of the potential threat(s) and actualized risks associated with such threats and incidents. Objectively measure reduction of adversary dwell time within judicial networks. Perform comprehensive analysis of security incidents for identification of root cause in support of detection improvements and risk mitigations.
Deliverables:
Image Duplication:
Duplication of evidence for processing by multiple analysts. Requests received via AOUSC ITSM (Heat or Service Now) Deleted Files:
Deleted files supplied to requestor. Advanced SME IR Reports
: Timely Advanced SME IR Support for Priority 1 Security Events. SME actively participating in IR activities within 4 hours of request (7x24x365). Incident Reports
: All forensic reports include a timeline. The timeline includes network, endpoint, and application events (if available). The report contains all data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable section. Forensic Reports:
Document the results of a forensic investigation. Report will include a table of contents, executive summary, timeline of events, and a conclusion. Malware Analysis Reports:
Document the results of analyzing a specific malware specimen. Report shall include a table of contents, executive summary, technical details, indication of persistence mechanisms and a conclusion. Provide
Weekly Reports
to the AOUSC Program Manager that documents all activities, tasks, tickets and documents worked on. Document repeatable
Standard Operation Procedures (SOPs)
and playbooks for security use cases.
Seniority level
Seniority level Mid-Senior level Employment type
Employment type Full-time Job function
Job function Sales, General Business, and Education Industries Wireless Services, Telecommunications, and Communications Equipment Manufacturing Referrals increase your chances of interviewing at cFocus Software Incorporated by 2x Sign in to set job alerts for “Forensic Analyst” roles.
Gaithersburg, MD $115,000.00-$125,000.00 3 weeks ago Digital Forensics and Incident Response Team Lead
Senior Forensic Scientist (Crime Scene Unit), Grade 26
Gaithersburg, MD $84,694.00-$136,188.00 1 week ago (2026 Bachelor's/Master's graduates) Cyber & Forensic Technology Consulting Analyst/Associate
Washington, DC $91,000.00-$95,000.00 5 hours ago Bethesda, MD $135,000.00-$165,000.00 3 weeks ago Gaithersburg, MD $115,000.00-$125,000.00 3 weeks ago Host Forensic Analyst/Host Based Systems Analyst
Arlington, VA $66,000.00-$106,000.00 2 weeks ago Fort Meade, MD $95,000.00-$130,000.00 7 hours ago Digital Forensic Analyst (TS/SCI)- Senior & Mid
Washington, DC $110,000.00-$125,000.00 2 weeks ago Tier 3 Digital Forensics and Incident Response Analyst
Washington, DC $155,000.00-$165,000.00 1 week ago Senior Schedule Forensics and Delay Claims Analyst
Washington, DC $107,000.00-$120,500.00 6 days ago Gaithersburg, MD $115,000.00-$125,000.00 3 weeks ago Digital Forensics and Incident Response Analyst - Tier 3
Washington, DC $150,000.00-$165,000.00 1 week ago Arlington, VA $86,000.00-$138,000.00 1 week ago We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
#J-18808-Ljbffr