Location:

Chantilly, VA Security Clearance:

Active TS or higher [Required]

Job Type:

Full-Time Target Salary Range

•: $110,000 - $160,000 This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

Position Overview:

Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion investigation, host-based forensic analysis, network traffic analysis, and attribution support within a highly sensitive operational environment. The ideal candidate will possess experience analyzing Splunk data, conducting host and network forensic analysis, and utilizing industry-standard forensic and cyber analysis tools to identify malicious activity, recover artifacts, and support investigative operations. Key Responsibilities Cyber Threat Analysis and Intrusion Investigation Process, evaluate, and analyze digital network communications and cyber threat data to identify malicious activity and support investigative operations. Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and network environments. Correlate digital artifacts, including IP addresses, URLs, malware indicators, system logs, and user activity across multiple data sources to support attribution and investigative lead generation. Support attribution and operational analysis by correlating threat indicators and investigative data. Host-Based Forensic Analysis Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets to identify indicators of compromise, attacker activity, persistence mechanisms, and unauthorized access. Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, command-line execution, and other system-level forensic evidence. Recover artifacts to support investigative operations. Network Traffic Analysis Analyze packet capture and NetFlow data to identify malicious communications, software usage, command execution, credential activity, and network-based indicators of compromise. Reporting, Process Development, and Quality Assurance Draft detailed technical reports and analytical findings based on cyber investigations. Participate in internal review and quality assurance processes. Support development and refinement of cyber analysis processes, CONOPS, SOPs, and investigative methodologies. Provide operational updates and analytical findings to leadership and investigative stakeholders. Threat Research and Mission Collaboration Conduct open-source and intelligence community research to maintain awareness of emerging cyber threats, malware trends, and adversary tactics, techniques, and procedures. Collaborate with internal teams and mission partners across the intelligence community to support tactical and strategic cyber operations. Qualifications Education BS/BA degree with 5+ years of relevant experience, or 9 years of relevant experience with no degree. Advanced certifications, specialized training, or equivalent hands-on experience may be considered in lieu of years of experience. Experience Experience performing host-based forensic analysis utilizing Splunk. Experience analyzing network traffic, packet capture, and NetFlow data. Hands-on experience with industry-standard forensic tools such as: Splunk EnCase Magnet AXIOM X-Ways Forensics Experience correlating threat indicators and investigative data to support attribution and operational analysis. Skills Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior, and forensic artifact analysis. Clearance Active Top Secret clearance required, with willingness and ability to obtain a Counterintelligence Polygraph.