Mobile Digital Forensic Investigator Jobs (NOW HIRING)

Location: Bethesda, MD (Hybrid; On-site as Required)

Clearance: Tier 2 Public Trust (Required)

Employment Type: Full-Time

Digital Global Connectors (DGC) is seeking an experienced Digital Forensics / Malware Analyst to support a Federal information security program. This position is responsible for conducting digital forensic investigations, malware analysis, evidence preservation, and advanced technical analysis to support cybersecurity incident response, threat intelligence, and cyber defense operations.

The Digital Forensics / Malware Analyst performs forensic acquisition and analysis of endpoints, servers, cloud resources, removable media, and other digital evidence; analyzes malicious software to understand attacker capabilities and intent; and provides technical expertise during cybersecurity investigations. The position works closely with Incident Responders, Threat Hunters, Security Engineers, Security Operations Center (SOC) personnel, ISSOs, and program leadership to identify root causes, support remediation efforts, and strengthen enterprise cybersecurity defenses.

The successful candidate will possess extensive experience performing forensic investigations, reverse engineering malware, analyzing attacker techniques, and preserving digital evidence in accordance with industry best practices.

• Conduct forensic acquisition and analysis of digital evidence from workstations, servers, mobile devices, cloud environments, virtual systems, and removable media.


• Preserve digital evidence using accepted forensic methodologies.


• Maintain chain of custody documentation throughout investigations.


• Recover deleted, encrypted, or concealed data when appropriate.


• Analyze file systems, registry artifacts, event logs, browser history, memory images, and system metadata.


• Support legal, administrative, and cybersecurity investigations through forensic analysis.

• Analyze malicious software using static and dynamic analysis techniques.


• Identify malware functionality, persistence mechanisms, command-and-control communications, and indicators of compromise (IOCs).


• Reverse engineer executable files, scripts, macros, and other malicious code.


• Evaluate malware behavior within controlled analysis environments.


• Document malware capabilities and defensive recommendations.


• Develop detection signatures and indicators supporting enterprise monitoring.

• Support Incident Responders during complex cybersecurity investigations.


• Assist in determining attack vectors, root cause, and scope of compromise.


• Validate forensic findings supporting containment and remediation decisions.


• Perform post-incident forensic analysis.


• Support lessons learned and after-action reviews.


• Provide technical expertise during major cybersecurity incidents.

• Acquire forensic images using approved forensic tools and procedures.


• Verify evidence integrity using cryptographic hash validation.


• Maintain secure evidence repositories.


• Document forensic methodologies, investigative actions, and evidence handling.


• Ensure evidence collection supports audit, investigative, and legal requirements.


• Maintain confidentiality throughout investigative activities.

• Identify attacker tactics, techniques, and procedures (TTPs).


• Analyze indicators of compromise (IOCs) and indicators of attack (IOAs).


• Correlate forensic findings with threat intelligence.


• Support attribution analysis where appropriate.


• Recommend improvements to enterprise detection and response capabilities.


• Assist Threat Hunters in identifying previously undetected malicious activity.

Utilize technologies including:

• EnCase Forensic


• FTK


• Magnet AXIOM


• Autopsy


• Velociraptor


• Volatility Framework


• Wireshark


• Ghidra


• IDA Pro


• x64dbg


• Microsoft Defender XDR


• Microsoft Defender for Endpoint


• Microsoft Sentinel


• Splunk Enterprise Security


• VirusTotal


• Cuckoo Sandbox


• Any.Run


• Security Information and Event Management (SIEM)


• Endpoint Detection and Response (EDR)

Support development of forensic procedures and analytical methodologies utilizing enterprise security technologies.

Develop and maintain:

• Digital Forensic Reports


• Malware Analysis Reports


• Root Cause Analyses


• Indicators of Compromise (IOC) Reports


• Technical Investigation Summaries


• Executive Briefings


• Evidence Logs


• Chain of Custody Documentation


• Lessons Learned


• Standard Operating Procedures

Ensure reports are technically accurate, well documented, and suitable for investigative, operational, and audit purposes.

• Coordinate with Incident Responders, Threat Hunters, Threat Intelligence Analysts, Security Engineers, ISSOs, SOC Analysts, System Owners, and Government stakeholders.


• Provide forensic expertise during cybersecurity investigations.


• Participate in incident response working groups.


• Present forensic findings to technical and non-technical audiences.


• Support enterprise cybersecurity exercises and forensic readiness initiatives.

• Monitor emerging malware families, attacker techniques, and forensic methodologies.


• Evaluate new forensic and malware analysis technologies.


• Recommend improvements to forensic processes and investigative procedures.


• Develop reusable forensic playbooks and investigation guides.


• Maintain professional certifications and technical expertise in digital forensics and malware analysis.

• Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Technology, Information Systems, or a related discipline.


• Minimum five (5) years of experience performing digital forensic investigations or malware analysis.


• Experience conducting forensic acquisition and analysis of Windows, Linux, and cloud environments.


• Experience analyzing malicious software and identifying attacker techniques.


• Experience using enterprise forensic and malware analysis tools.


• Strong analytical, investigative, technical writing, and communication skills.


• U.S. Citizenship required.


• Ability to obtain and maintain a Tier 2 Public Trust.

• Master's degree in Cybersecurity, Digital Forensics, Computer Science, or a related discipline.


• Experience supporting a Federal civilian agency.


• Experience performing memory forensics and reverse engineering.


• Experience supporting enterprise incident response operations.


• GIAC Certified Forensic Analyst (GCFA)


• GIAC Reverse Engineering Malware (GREM)


• GIAC Network Forensic Analyst (GNFA)


• Certified Hacking Forensic Investigator (CHFI)


• EnCase Certified Examiner (EnCE)


• Certified Information Systems Security Professional (CISSP) (preferred)

• Digital Forensics


• Malware Analysis


• Reverse Engineering


• Memory Forensics


• Incident Response


• Threat Analysis


• Indicators of Compromise (IOCs)


• Indicators of Attack (IOAs)


• Windows Forensics


• Linux Forensics


• Cloud Forensics


• EnCase


• FTK


• Magnet AXIOM


• Autopsy


• Velociraptor


• Volatility Framework


• Wireshark


• Ghidra


• IDA Pro


• Microsoft Sentinel


• Splunk Enterprise Security


• Microsoft Defender XDR


• Microsoft Defender for Endpoint


• Security Information and Event Management (SIEM)


• Endpoint Detection and Response (EDR)


• MITRE ATT&CK Framework


• Technical Documentation


• Microsoft Office Suite


• ServiceNow


• Jira

• Ability to successfully obtain and maintain a Tier 2 Public Trust investigation.


• Compliance with all applicable Federal security, privacy, ethics, and information assurance training requirements before receiving system access.


• Ability to support cybersecurity investigations, incident response activities, scheduled maintenance windows, continuity of operations (COOP), and surge support as required.


• Must maintain strict confidentiality while handling digital evidence, forensic images, malware samples, investigative findings, and Federal information systems.


• Ability to conduct detailed forensic investigations, analyze sophisticated malware, preserve evidentiary integrity, and provide timely technical findings that support Government stakeholders, cybersecurity operations, and enterprise risk reduction.