Digital Forensics Analyst

When you join AIS, you're joining a mission-driven team that's passionate about making a difference. You'll work on projects that matter, alongside industry-leading experts, in an environment that fosters innovation, driving client success, and empowering our team to make a lasting impact. As an employee-owned company, we value collaboration, inclusivity, continuous growth, and shared success.

• Employee Ownership: Your contributions directly impact the company's success, and you share in its achievements.

• Continuous Learning: Access to resources, training, and mentorship to support your professional growth.

• Inclusive Culture: A workplace where diversity is celebrated, and everyone's voice is valued.

• Mission-Driven Work: Engage in projects that make a meaningful difference for our clients and communities.

At AIS, we're looking for more than just skills - we're looking for driven individuals who are passionate about making a difference, eager to grow, and aligned with our core principles.

This position is contingent upon contract award. We are currently pursuing a proposal and are seeking qualified candidates to include in our submission and identify candidates for future hiring needs on the program once awarded.

• Core Knowledge & Skills: Designs secure architectures, leverages advanced threat detection, leads incident response, and implements security automation.

• Work & Complexity: Manages complex incidents, conducts threat analysis, leads audits, and implements process improvements.

• Quality & Independence: Delivers high-quality reports, aligns practices with industry standards, and operates with high autonomy.

• Teamwork & Communication: Leads team projects, collaborates cross-functionally, mentors juniors, and resolves conflicts.

• Consulting & Engagement: Provides strategic consulting, leads improvement initiatives, recommends advanced technologies, and manages vendor relationships.

The Digital Forensics Analyst is responsible for conducting advanced forensic examinations across a wide range of digital systems, environments, and devices. This role performs deep-dive investigations involving endpoint activity, network traffic, malware, cloud platforms, and virtualized environments. The ideal candidate has hands-on experience with digital media acquisition, malware analysis, cloud forensics, and the use of modern security technologies to support threat hunting and investigative operations.

Digital Forensic Analysis

• Conduct forensic examinations on Windows, Linux, and MacOS systems.

• Perform digital media acquisition, including disk imaging, preservation, and chain-of-custody documentation.

• Execute mobile device acquisition and analysis, including iOS and Android platforms.

• Perform malware analysis to determine behavior, indicators of compromise (IOCs), and impact.

Cloud & Virtual Environment Forensics

• Investigate virtualized environments, including Virtual Machines and associated logs/artifacts.

• Perform cloud-based forensic analysis using:

  • Microsoft 365

  • Azure

  • AWS

• Analyze cloud-native logs such as CloudTrail, IAM logs, and other platform security telemetry.

Threat Hunting & Investigative Activities

• Utilize EDR, SIEM, and full packet capture tools to examine endpoint behavior, network activity, and anomalous patterns.

• Conduct proactive threat hunting to identify previously undetected malicious activity.

• Correlate forensic data with threat intelligence to support broader investigations.

Tools, Documentation & Reporting

• Leverage industry-standard forensic tools, including EnCase and SANS methodologies.

• Generate detailed forensic reports for technical stakeholders, legal teams, and leadership.

• Maintain strict adherence to evidence handling, analysis integrity, and investigative best practices.

• Minimum of 5 years of experience conducting or supporting digital forensic investigations, including:

  • Windows, Linux, and MacOS forensic analysis

  • Disk imaging and media preservation

  • Mobile device forensic acquisition and analysis

  • Malware analysis

• Experience conducting forensic investigations in M365, Azure, and AWS environments.

• Ability to analyze virtualized systems and cloud-native telemetry (CloudTrail, IAM logs).

• Extensive experience using:

  • Endpoint Detection & Response (EDR)

  • Security Information & Event Management (SIEM)

  • Full packet capture platforms

• Strong analytical, documentation, and evidence-handling skills.

• Clearance: Secret

Certifications: One or more of these certifications

• SANS GIAC

• GCIH - Incident Handler

• GCFA - Forensic Analyst

• GCFE - Forensic Examiner

• GREM - Malware Reverse Engineering

• GISF - Information Security Fundamentals

• GXPN - Exploit Research & Advanced Pen Testing

• GCTI - Cyber Threat Intelligence

• GOSI - Open-Source Intelligence

• EnCase Certifications (EnCE, CFSR, ENCEP)

• Experience working in federal, law enforcement, or regulated environments.

• Background in threat intelligence and advanced incident response.

• Familiarity with scripting or automation (Python, PowerShell) for forensic workflows.

Applied Information Sciences does not discriminate on the basis of race, national origin, religion, color, gender, sexual orientation, age, disability, protected veteran status, or any other basis. Employment decisions are based solely on qualifications, merit, and business needs.