Cyber Defense Forensic Analyst I

The Cyber Defense Forensic Analyst I role support’s CME Group’s Cyber Defense Team by performing collection and analysis of host, network, and log data to support HR, Legal, and Information Security incidents.  In addition to forensic analysis, the role also supports event analysis and incident handling, as required.

Primary Responsibilities: 

• Forensically collect and preserve evidence from end user systems, servers, network data repositories, and other log repositories as required.
• Create forensic images of RAM, Hard Disks, and unstructured log data.
• Complete required documentation during the collection of forensic data.
• Perform structured analysis of forensic artifacts under the supervision of a senior forensic analyst.

Technical Skills:

• Network Concepts – TCP/IP Fundamentals, Common Ports/Protocols, etc.
• Network Forensics / Analysis – Flow data analysis, PCAP analysis, etc.
• Host Based Forensics – Collection of forensic images, understanding of common forensic artifacts
• Memory Forensics – Collection of memory images, basic analysis of memory images using industry standard toolsets
• Log Analysis – Familiarity with common log files/formats, ability to summarize log data using common command line/log analysis tools

Personal Attributes:

• Strong customer-service orientation.
• Strong analytical and troubleshooting skills
• High level critical thinking skills.
• Excellent written and oral communication skills.
• Excellent listening and interpersonal skills.
• Ability to communicate ideas in both technical and user-friendly language.
• Ability to conduct research into network/security issues and products.
• Comfortable working in a dynamic environment with multiple goals.
• Highly self-motivated and directed, with keen attention to detail.
• Able to prioritize and execute tasks in a high-pressure environment.
• Experience working in a team-oriented, collaborative environment.
• Ability to deal diplomatically and effectively at all levels of the organization including both technical and non-technical, management and senior leadership

  Professional Experience:

• 0 - 2 years of experience in Forensics or Information Security is typical for this position.

• Successful candidates should be able to demonstrate a passion for information security through course work/degrees completed, self-study, and/or certifications that have been completed

Formal Education & Certifications

• BA/BS in Engineering, Computer Science, Information Security, or Information Systems or related work experience
• Certifications such as SANS GSEC or GCFE, Security+, or CySA+