Network Forensics Defense Analyst

Job Description

Job Description

Network Forensics Defense Analyst

Location: Remote / Onsite (as required)
Clearance: Active TS/SCI (DHS EOD eligibility required)
Company: Argo Cyber Systems, LLC – A Service-Disabled Veteran-Owned Small Business (SDVOSB)

Argo Cyber Systems delivers advanced cybersecurity and threat-hunting capabilities to safeguard federal and critical infrastructure environments. Our teams provide rapid incident response, digital forensics, proactive hunt operations, and continuous cyber defense across host-based, network-based, and cloud-based systems. We combine mission experience with innovation-empowering our customers to detect, disrupt, and defeat adversaries in real time.

The DHS Hunt and Incident Response Team (HIRT) secures the nation's infrastructure. HIRT provides DHS's front-line response for cyber incidents and proactive hunting for malicious cyber activity. Argo Cyber provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. Argo Cyber delivers HIRT advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.

Argo Cyber is seeking a Network Forensics Analyst with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.

Responsibilities
• Serves as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.
• Serves as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.
• Assists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
• Assists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.
• Characterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.
• Identifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.
• Reconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.
• Examines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.
• Assesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
• Determines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
• Applies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.
• Applies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
• Leads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
• Provides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.
• Serves as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
• Exercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.
• Analyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
• Advises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).
• Supports internal stakeholders on containment and eradication missions, on-site and remotely.
• Ensures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
• Assists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.
• Distills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.
• Documents analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.
• Assists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.

Required Skills
• U.S. Citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• 8+ years of directly relevant experience
• 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.
• Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to:
o Characterize and analyze network traffic to identify anomalous activity and potential threats.
o Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.).
o Reconstruct malicious activity based on network traffic and device logs.
• Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.
• Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic.
• Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
• Proficiency with common operating systems (e.g., Linux/Unix, Windows).
• Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.
• Ability to think independently, make sound decisions under pressure, and work with limited guidance.
• Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.
• Ability to work collaboratively across physical locations and within distributed teams.
• Skilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.
• Rapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air-gapped traffic.

Desired Skills
• Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
• Network and system administration experience in large or complex enterprise or service-provider environments.
• Strong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non nation state adversaries, nation state actors).
• Knowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures.
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, malicious code).
• Knowledge of network device integrity verification and monitoring approaches.
• Hands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM).
• Experience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection.
• Experience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures.
• Ability to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture-level improvements.
• Ability to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership).
• Field Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate.
• Compact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry-on/air-transport limits.

Required Education
• BS in Computer Science, Cyber Security, Computer Engineering, or related degree;
OR HS Diploma and 10+ years of technical experience in the area of expertise.

Desired Certifications (One or more)
• IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH,
• SANS GIAC GCIA or GNFA (preferred for network forensics).
• SANS GRID, GICSP, or GCIP (plus).
• Vendor / network certifications (highly desired):
o Cisco CCNA (or higher: CCNP Security, CCNP Enterprise).
o Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.).

At Argo, you'll be part of a mission-driven, veteran-founded cybersecurity team protecting America's most critical systems. We combine hands-on technical excellence with operational precision to outpace the threat. Join us to defend, detect, and innovate at the cyber edge.