Forensics Specialist

Job Description

WarCollar Industries has an immediate opportunity for an experienced Digital Forensics & Incident Response (DFIR) Specialist to support a mission-critical national security customer in Herndon, VA. The DFIR Specialist will lead the detection, containment, and forensic investigation of complex cybersecurity incidents across enterprise and cloud environments.

This role will serve as a senior technical responder responsible for investigating active cyber threats, acquiring and preserving digital evidence, analyzing host and network telemetry, and reconstructing attack timelines to identify threat actor activity and root causes. The ideal candidate will bring extensive hands-on experience in digital forensics, incident response, and advanced threat hunting, along with the ability to translate complex forensic findings into actionable remediation strategies and enterprise-wide security improvements.

Key Responsibilities

Conduct advanced digital forensic investigations, including live memory analysis, disk imaging, and forensic data acquisition across enterprise systems and cloud-based endpoints while maintaining strict chain-of-custody procedures.

Analyze endpoint artifacts, cloud telemetry, system logs, and network data to identify indicators of compromise (IOCs), reconstruct attack timelines, and determine threat actor tactics, techniques, and procedures (TTPs).

Coordinate directly with customer personnel and affected end users to implement immediate threat containment, eradication, and recovery strategies.

Perform proactive and reactive threat hunting across enterprise networks to identify advanced persistent threats (APTs), malicious activity, and hidden persistence mechanisms.

Conduct detailed root-cause analyses and develop comprehensive technical forensic reports to support incident remediation, recovery planning, and recommended network modifications.

Advise customer leadership and technical stakeholders on cybersecurity risks, technical impacts, zero-day vulnerabilities, emerging threats, and potential impacts to organizational equities.

Collaborate with cyber defense and engineering teams to develop and deploy tactical signature updates, endpoint detection rules, and enterprise-wide security countermeasures following security incidents.

Identify deficiencies in existing logging, monitoring, and network visibility architectures, providing actionable recommendations to strengthen continuous monitoring and incident detection capabilities.

Support the development and refinement of incident response procedures, forensic methodologies, and technical security controls to improve organizational cyber defense capabilities.

,

Required Skills

Minimum of 11 years of cybersecurity experience supporting Government programs, including at least 2 years of dedicated experience in host/network forensics, advanced threat hunting, or Tier 3 incident response.

Hands-on experience with commercial and open-source digital forensic tools and platforms, such as Magnet AXIOM, X-Ways Forensics, FTK, EnCase, Volatility, or KAPE.

Experience utilizing Enterprise Detection and Response (EDR/XDR) platforms to investigate, analyze, and respond to advanced cyber threats.

Demonstrated experience analyzing host-based artifacts, including Master File Table (MFT), Windows Registry, system event logs, volatile memory, and network packet captures (PCAP).

Ability to reconstruct complex cyber attacks, identify indicators of compromise, and determine root causes through detailed forensic analysis.

Strong understanding of incident response methodologies, threat actor behaviors, network security, and advanced persistent threats.

Excellent written and verbal communication skills, with the ability to translate complex technical findings into concise reports and executive-level briefings.

DoD 8570 IAT Level II certification compliance or higher.

,

Desired Skills

Bachelor's degree in Digital Forensics, Cybersecurity, Computer Engineering, Computer Science, Information Technology, or a closely related discipline.

SANS certifications or CompTIA Cybersecurity Analyst (CySA+) certification.

Experience supporting advanced cyber defense operations within the Intelligence Community or Department of Defense.

Familiarity with cloud forensics, enterprise endpoint security, advanced threat detection, and forensic evidence preservation.

Experience developing technical recommendations to improve enterprise security architecture, logging capabilities, and continuous monitoring operations.

,

About WarCollar Industries

About us:
WarCollar Industries, LLC is a veteran-owned small business. We maintain a team of cybersecurity experts committed to protecting complicated data and distribution systems and providing decision makers with the most accurate assessment of residual risk possible. We work with our clients to solve the toughest challenges in the ever-evolving digital landscape. Services include network defense, computer network attack, secure network design, penetration testing and vulnerability assessment. WarCollar enables its clients to find, fix, stop, and ultimately solve cybersecurity problems across their entire enterprise.

WarCollar offers generous benefits including: Medical insurance premium coverage; PTO based on billable hours; federal holidays plus your birthday; matching 401k, education reimbursement plus paid training days; performance bonuses; referral bonuses; government shutdown protection; monthly team building events plus two major social events annually.

WarCollar Industries, LLC is an equal opportunity employer. WarCollar does not discriminate in employment based upon race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, status as a protected military veteran, or other non-merit factor.