**Position is Contingent Upon Award**
Peraton seeks innovative professionals who thrive in mission-critical environments and are passionate about protecting our national critical infrastructure. This is your chance to make an impact on one of the nation’s vital organizations, working alongside leaders in cybersecurity engineering, operations, forensics, threat analysis, data science, and systems integration.
Join Peraton in supporting a large critical infrastructure operator to defend its corporate and operations networks from nation-state attacks, ensure the confidentiality, integrity, and availability of its systems and operations infrastructure, and comply with federal and industry cybersecurity regulation. As a forensic and incident response engineer working alongside a state of the art 24-hour Cybersecurity Operations Center (CSOC), you will be responsible for detecting, investigating, and responding to cybersecurity incidents while preserving evidence and supporting root-cause analysis. This role leads technical incident response activities, conducts digital forensic analysis, and improves organizational readiness against cyber threats.
Primary Responsibilities:
The Forensic and Incident Response Engineer will be responsible to:
-
Lead technical response to security incidents, including containment, eradication, and recovery
-
Perform digital forensic analysis on endpoints, servers, applications, network traffic, and cloud environments using forensically sound procedures to identify network / computer intrusion evidence and identifies perpetrators
-
Examine any electronic device that may hold evidence that could be used in a court of law and
- Gather, handle and store evidence.
- Perform a variety of forensic and electronic discovery services, including digital evidence preservation, forensic analysis, data recovery, tape recovery, electronic mail extraction, and database examination
-
Collect, preserve, and analyze evidence in accordance with forensic best practices and legal requirements observing proper evidence custody and control procedures, document procedure and findings in a manner suitable for courtroom presentation and prepare comprehensive written notes and reports.
-
Investigate malware, intrusions, unauthorized access, and data infiltration and exfiltration events
-
Analyze logs, memory, disk images, and network captures to determine attack scope and impact
-
Develop timelines, root-cause analysis, and incident reports for both technical and executive audiences
-
Support threat hunting and detection engineering efforts using forensic findings
-
Collaborate with the CSOC, engineering, legal, and compliance teams during incidents
-
Participate in on-call or surge incident response rotations
Additional Responsibilities:
-
Assist with development and maintenance of incident response playbooks and procedures
-
Support security tooling evaluations and forensic lab improvements
-
Participate in tabletop exercises and readiness testing
-
Contribute to security awareness or training efforts using incident lessons learned
-
Maintain forensic documentation, case notes, and evidence records
#PLABS26
