Cyber Defense Forensics Analyst [Various Levels] Contingent

Cybersecurity Operations (CSO)

612 - Cyber Defense Forensics Analyst

Intermediate

No

Active Secret or Top Secret

Personnel assigned to this role must satisfy the foundational qualification requirements for DCWF Work Role 612 at an Intermediate proficiency level prior to commencing work. Qualifying certifications across proficiency tiers include:

The Cyber Defense Forensics Analyst serves within the Cybersecurity Operations (CSO) capability area to support incident response, threat analysis, and digital evidence processing for global C4ISR and distribution operations. Operating in accordance with DoDM 8140.03 standards, this role performs deep-dive technical investigations, host and network-level artifact recovery, and threat timeline reconstruction to ensure operational effectiveness and mission assurance during active security events.

• →Digital Forensics & Artifact Collection: Execute digital forensic collections, host-based memory analysis, disk image acquisition, and reverse engineering during operational security incidents.
• →Evidence Handling & Chain of Custody: Maintain strict evidence handling and legal chain-of-custody protocols for all collected host artifacts, network packet captures, and system memory dumps.
• →Threat Analysis & Reconstruction: Evaluate disk images, volatile memory, system logs, and network traffic captures to reconstruct attack vectors, establish timelines, and determine breach scope and impact.
• →Incident Response Technical Support: Assist in technical measures to isolate, contain, eradicate, and recover from security events upon direction from the COR.
• →Reporting & CDRL Deliverables: Author comprehensive forensic investigation reports and provide technical analysis inputs for formal Security Incident Reports.

• Technical degree in Cybersecurity, Computer Science, Information Technology, or a related field, OR 5+ years of direct operational experience in digital forensics and cyber incident response.

Security+, GCFE, CCFP

SecurityX (CASP+), CISSP, GCFA

• Workforce Qualification Compliance: Contractor personnel must be fully qualified and certified prior to performance. Compliance is tracked and verified via the Personnel Qualification & Certification Report (CDRL A008) and quarterly training rosters (CDRL A050).
• Privileged Access Requirements: Must meet residential qualification requirements for elevated or privileged network access prior to performing technical duties.
• Security Program Adherence: Execute all information handling in strict accordance with AR 380-5 for classified data and DoDI 5200.48 for Controlled Unclassified Information (CUI).