Threat Hunt Analyst - High - Digital Forensics

Koniag Data Solutions, LLC, a Koniag Government Services company, is seeking a Threat Hunt Analyst - High - Digital Forensics to support KDS and our government customer in Washington, DC. This position requires the candidate to be able to obtain a Public Trust. We offer competitive compensation and an extraordinary benefits package including health, dental and vision insurance, 401K with company matching, flexible spending accounts, paid holidays, three weeks paid time off, and more. Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced Senior Threat Hunt Analyst with advanced Digital Forensics capabilities to support the U.S. Small Business Administration (SBA). The ideal candidate is a highly skilled cybersecurity professional with deep expertise in proactive threat hunting, advanced digital forensics investigation, and incident response within complex federal IT environments. This individual will play a pivotal role in identifying and neutralizing advanced persistent threats (APTs) and sophisticated adversaries targeting SBA's critical systems and data, leveraging cutting-edge forensic techniques, threat intelligence, and adversary emulation knowledge to stay ahead of the evolving threat landscape facing the agency. The Senior Threat Hunt Analyst will serve as a highly experienced cybersecurity professional responsible for designing and leading proactive threat hunting programs and conducting advanced digital forensics investigations in support of SBA's cybersecurity mission. This individual will bring deep technical expertise in adversary TTPs, forensic analysis, and malware reverse engineering to proactively identify hidden threats, support complex incident investigations, and continuously strengthen SBA's defensive capabilities. Principal responsibilities will include but are not limited to: • Design, develop, and lead proactive threat hunting programs and targeted hunting campaigns across SBA's enterprise IT environment, including on-premises, cloud, and hybrid infrastructures, leveraging advanced analytical techniques, behavioral analytics, and threat intelligence to identify hidden adversaries, undetected malicious activity, and emerging threats before they impact SBA operations. • Apply expert-level knowledge of threat actor tactics, techniques, and procedures (TTPs) and the MITRE ATT&CK framework to develop, prioritize, and execute hypothesis-driven threat hunts targeting high-priority adversary behaviors, attack patterns, and threat vectors relevant to SBA's mission and threat landscape. • Conduct advanced digital forensics investigations in response to cybersecurity incidents and threat hunt findings, including the forensically sound acquisition, preservation, and analysis of digital evidence from endpoints, servers, network devices, cloud environments, and mobile platforms, in strict accordance with federal forensic standards and chain of custody requirements. • Perform advanced malware analysis, including both static analysis techniques (e.g., disassembly, decompilation, string analysis, import analysis) and dynamic analysis techniques (e.g., behavioral sandbox analysis, API monitoring, network traffic analysis), to fully characterize the capabilities, behaviors, persistence mechanisms, and indicators of compromise (IOCs) associated with malicious code identified within SBA's environment. • Conduct in-depth analysis of network traffic captures, memory artifacts, disk images, log data, and endpoint telemetry to reconstruct detailed attack timelines, identify root causes, characterize adversary TTPs, and determine the full scope and impact of security incidents and threat hunt findings. • Develop and maintain a comprehensive library of threat hunting hypotheses, hunt playbooks, and forensic investigation procedures, ensuring they remain current with the evolving threat landscape, emerging adversary TTPs, and changes to SBA's operational IT environment. • Produce detailed, high-quality forensic examination reports, threat hunt reports, and after-action reviews (AARs) documenting investigation methodologies, findings, evidence analysis, attack timelines, and actionable recommendations for SBA leadership, stakeholders, and inter-agency partners. • Collaborate closely with the SOC team, Cybersecurity Operations Technical Lead, Cybersecurity Architect, and SBA security leadership to share threat hunt findings, integrate newly identified IOCs, detection signatures, and behavioral analytics into SOC monitoring tools, and drive continuous improvement of SBA's detection and response capabilities. • Operationalize threat intelligence from government and commercial sources, including US-CERT, CISA, ISACs, and commercial threat intelligence platforms, to inform and prioritize threat hunting campaigns, guide forensic investigations, and enhance SBA's overall cyber defense posture. • Provide senior technical expertise and support during significant cybersecurity incidents, leading forensic investigation activities and coordinating with US-CERT, CISA, and other federal partners as needed to support effective incident response and inter-agency coordination. • Develop and tune SIEM detection rules, correlation logic, and behavioral analytics based on threat hunt findings and forensic investigation results to improve the SOC's ability to detect and respond to identified and emerging adversary TTPs targeting SBA systems. • Conduct vulnerability research and exploitability analysis to assess the real-world risk of vulnerabilities affecting SBA systems, informing remediation prioritization and supporting the understanding of potential adversary exploitation paths. • Deliver expert technical briefings and presentations to SBA leadership, stakeholders, and inter-agency partners on threat hunt findings, forensic investigation results, emerging threats, and recommendations for strengthening SBA's cybersecurity posture. • Mentor and provide advanced technical guidance to SOC analysts and junior threat hunt and forensics team members, elevating team capabilities in threat hunting methodologies, digital forensics techniques, and malware analysis practices. • Support the continuous improvement of SBA's threat hunting and digital forensics program, including the evaluation and recommendation of new tools, technologies, and methodologies to enhance program effectiveness and efficiency. Education and Experience: Required: • Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics, Information Technology, or a related field from an accredited college or university. • 8+ years of progressive experience in cybersecurity operations, with at least 4 years of dedicated, hands-on experience in threat hunting, digital forensics, and/or malware analysis in a senior or lead capacity within a SOC, CSIRT, or dedicated threat hunting team. • Demonstrated experience conducting advanced digital forensics investigations and proactive threat hunting operations within a federal government or large enterprise IT environment. • One or more of the following certifications: • GIAC Certified Forensic Analyst (GCFA) • GIAC Certified Forensic Examiner (GCFE) • GIAC Reverse Engineering Malware (GREM) • GIAC Certified Incident Handler (GCIH) • GIAC Certified Enterprise Defender (GCED) • EnCase Certified Examiner (EnCE) • Certified Forensic Computer Examiner (CFCE) • Offensive Security Certified Professional (OSCP) • Certified Information Systems Security Professional (CISSP) Desired: • Master's degree in Cybersecurity, Digital Forensics, Computer Science, or a related field. • 10+ years of cybersecurity experience with a strong and demonstrated focus on threat hunting, digital forensics, and malware analysis within a federal government or defense contracting environment. Required Skills and Competencies: • Exceptional communication skills in English – both written and oral – with the ability to clearly and effectively articulate complex forensic