Cloud Forensic Analyst IV with Security Clearance

Nightwing provides technically advanced full‑spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers' most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets. Nightwing is supporting a U.S. Government customer to provide onsite incident response for civilian government agencies and critical asset owners experiencing cyber‑attacks. We deliver immediate investigation and resolution through the characterization of breaches, development of mitigation plans, and assistance with the restoration of services. Job Summary We are seeking a Cloud Forensics Analyst to support this critical customer mission. The position provides ample opportunities for training and career growth within the Cloud Forensics field. Responsibilities Acquire and collect computer artifacts (e.g., malware, user activity, link files) in support of onsite engagements. Triage electronic devices and assess evidentiary value. Correlate forensic findings to network events to develop an intrusion narrative. Collect and document system state information (e.g., running processes, network connections) prior to imaging, as required. Perform forensic triage of an incident, determining scope, urgency, and potential impact. Track and document forensic analysis from initial participation through resolution. Collect, process, preserve, analyze, and present computer‑related evidence. Coordinate with Government staff and customer personnel to validate or investigate alerts or preliminary findings. Conduct analysis of forensic images and available evidence to produce forensic write‑ups for reports and written products. Assist with documenting and publishing Computer Network Defense (CND) guidance and incident‑related reports. Required Skills & Clearances U.S. citizenship Active TS/SCI clearance Ability to obtain Department of Homeland Security (DHS) Entry on Duty (EOD) suitability 10 years of direct relevant experience in cyber forensic investigations using leading‑edge technologies and industry‑standard forensic tools In‑depth understanding of SaaS, PaaS, and IaaS in the cloud environment Ability to create forensically sound duplicates of evidence (forensic images) Ability to author cyber investigative reports documenting digital forensics findings Proficiency with analysis and characterization of cyber attacks Proficiency with proper evidence‑handing procedures and chain‑of‑custody protocols Skilled in identifying different classes of attacks and attack stages Understanding of system and application security threats and vulnerabilities Understanding of proactive analysis of systems and networks, including creating trust levels of critical resources Able to work collaboratively across physical locations Action‑oriented and proactive problem‑solving approach Proficiency with common operating systems (Linux/Unix, Windows) Desired Skills Knowledge of M365/Azure authentication strategies and federated identity solutions, and how threat actors target identity to compromise an environment Advanced experience and proficiency across IT operations (networking, virtualization, identity, security, business continuity, disaster recovery, data management, governance) Experience and understanding in acquisition, processing, and analysis of digital evidence from onsite enterprises and cloud‑native platforms Fundamental understanding of APIs and proficiency with PowerShell/PowerShell modules for API queries related to Azure/M365 Proficiency with scripting languages (Bash, Python, PowerShell, JS) for automation of hunt tools used in commercial cloud environments Ability to develop tools, architecture, and configurations in Azure to support threat‑activity identification Advanced Azure administration, M365 administration, and/or development/DevOps skills Understanding of Azure/M365 platform protection implementations and available security operations Required Education BS in Computer Science, Cybersecurity, Computer Engineering, or related degree; or HS diploma with 10 years of host or digital forensics experience. Desired Certifications GCFA, GCFE, GCIH, EnCE, CCE, CFCE, CISSP AWS Practitioner AWS Certified Developer AWS Certified SysOps Administrator AWS Certified Architect Kubernetes Security Specialist MS‑500: Microsoft 365 Security Administration AZ‑900: Azure Fundamentals AZ‑500: Azure Security Technologies AZ‑303: Azure Architect Technologies AZ‑304: Azure Architect Design MS‑100: Microsoft 365 Identity and Services MS‑101: Microsoft 365 Mobility and Security AZ‑104: Azure Administrator SANS SEC 510, Public Cloud Security: AWS, Azure, and GCPS SANS FOR509: Enterprise Cloud Forensics and Incident Response (BETA) SEC 541: Cloud Monitoring and Threat Detection SEC 584: Cloud Native Security: Defending Containers and Kubernetes SEC 588: Cloud Penetration Testing AWS Certified Cloud Practitioner AWS Certified SysOps Administrator Associate AWS Certified Developer Associate AWS Certified Solutions Architect Associate AWS Certified Solutions Architect Professional AWS Certified DevOps Engineer Professional Equal Opportunity Statement Nightwing is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class. #J-18808-Ljbffr Nightwing