[Hiring] Cloud Analyst @Booz Allen Hamilton

Role Description

The Opportunity:

• Display professional and expert knowledge of incident response processes, tools, and techniques.
• Collect, analyze, and present digital-related evidence in support of Business Email Compromise (BEC) investigations.
• Apply specific functional, working, and general industry knowledge.
• Develop or contribute to solutions to a variety of problems of moderate scope and complexity.
• Work independently with some guidance and make significant contributions to any incident response efforts.
• Provide written or verbal updates to clients.

Qualifications

• 3+ years of experience with Digital Forensics and Incident Response (DFIR), Incident Response (IR), or BEC investigation.
• Experience with the collection and analysis of logs in Microsoft 365 (M365).
• Experience with scripted BEC toolsets written in PowerShell.
• Knowledge of common forensic artifacts analyzed during an investigation.
• Ability to correlate events from multiple sources to create a timeline analysis.
• Ability to organize case notes and communicate verbally and in writing to clients.
• Ability to lead fast-paced cloud investigations from beginning to end, including creating and presenting forensic findings and writing executive summary reports.
• Ability to work after standard business hours, including evenings, weekends, and holidays, take a rotation on call, and work more than one incident at a time.
• HS diploma or GED.

Requirements

• Experience with the collection and analysis of logs in Microsoft Exchange on-premises logs or Google Workspace Logs.
• Experience with email header analysis.
• Experience with the collection and analysis of other email platforms.
• Experience with forensically analyzing cloud data, including AWS, Azure, or GCP.
• Experience in scripting with PowerShell or Python.
• Experience with digital forensic tools, including EnCase, FTK Axiom, Splunk, ELK Stack, and open-source applications.
• Ability to prepare detailed technical reports.
• Ability to prioritize work assignments without guidance.
• DFIR or Cybersecurity Certification such as CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA Certification.

Benefits

• Health, life, disability, financial, and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards program for exceptional performance.