Network Forensics Defense Analyst
Location: Remote / Onsite (as required) Clearance: Active TS/SCI (DHS EOD eligibility required) Company: Argo Cyber Systems, LLC – A Service-Disabled Veteran-Owned Small Business (SDVOSB)
About Argo Cyber Systems
Argo Cyber Systems delivers advanced cybersecurity and threat-hunting capabilities to safeguard federal and critical infrastructure environments. Our teams provide rapid incident response, digital forensics, proactive hunt operations, and continuous cyber defense across host-based, network-based, and cloud-based systems. We combine mission experience with innovation-empowering our customers to detect, disrupt, and defeat adversaries in real time.
Position Overview
The DHS Hunt and Incident Response Team (HIRT) secures the nation's infrastructure. HIRT provides DHS's front-line response for cyber incidents and proactive hunting for malicious cyber activity. Argo Cyber provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. Argo Cyber delivers HIRT advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.
Argo Cyber is seeking a Network Forensics Analyst with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.
Responsibilities
- Serves as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.
- Serves as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.
- Assists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
- Assists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.
- Characterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.
- Identifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.
- Reconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.
- Examines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.
- Assesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
- Determines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
- Applies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.
- Applies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
- Leads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
- Provides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.
- Serves as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
- Exercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.
- Analyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
- Advises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).
- Supports internal stakeholders on containment and eradication missions, on-site and remotely.
- Ensures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
- Assists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.
- Distills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.
- Documents analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.
- Assists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.
Required Skills
- U.S. Citizenship.
- Active TS/SCI clearance.
- Ability to obtain DHS Suitability.
- 8+ years of directly relevant experience
- 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.
- Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
- Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
- Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
- Ability to: o Characterize and analyze network traffic to identify anomalous activity and potential threats. o Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.). o Reconstruct malicious activity based on network traffic and device logs.
- Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.
- Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic.
- Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
- Proficiency with common operating systems (e.g., Linux/Unix, Windows).
- Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.
- Ability to think independently, make sound decisions under pressure, and work with limited guidance.
- Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.
- Ability to work collaboratively across physical locations and within distributed teams.
- Skilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.
- Rapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air-gapped traffic.
Desired Skills
- Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
- Network and system administration experience in large or complex enterprise or service-provider environments.
- Strong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non nation state adversaries, nation state actors).
- Knowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures.
- Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, malicious code).
- Knowledge of network device integrity verification and monitoring approaches.
- Hands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM).
- Experience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection.
- Experience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures.
- Ability to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture-level improvements.
- Ability to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership).
- Field Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate.
- Compact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry-on/air-transport limits.
Required Education
- BS in Computer Science, Cyber Security, Computer Engineering, or related degree; OR HS Diploma and 10+ years of technical experience in the area of expertise.
Desired Certifications (One or more)
- IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH,
- SANS GIAC GCIA or GNFA (preferred for network forensics).
- SANS GRID, GICSP, or GCIP (plus).
- Vendor / network certifications (highly desired): o Cisco CCNA (or higher: CCNP Security, CCNP Enterprise). o Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.).
Why Argo Cyber Systems
At Argo, you'll be part of a mission-driven, veteran-founded cybersecurity team protecting America's most critical systems. We combine hands-on technical excellence with operational precision to outpace the threat. Join us to defend, detect, and innovate at the cyber edge.