Cyber Investigations

Cyber Investigations Engineer Jobs

2 jobs found

1mo ago

Security Engineer III, Exploitation Analyst / Incident Responder

Deloitte Baltimore, MD

Baltimore, MD

1mo ago Closed

$103k - $189k/yr Full time Cyber Forensics Cyber Investigation Cyber Investigations

This position is no longer accepting applications (closed Sep 24, 2026).

Job Description

Deloitte’s Cyber Defense & Resilience team helps clients defend against advanced threats by strengthening security operations, monitoring technology, data analytics, and threat intelligence. You’ll support efforts to manage and protect dynamic attack surfaces, and help enable rapid crisis and cyber incident response so clients can be ready for, respond to, and recover from business disruptions.

What you’ll do

As a Cyber Exploitation Analyst and Incident Responder, you will analyze threat activity and investigate incidents across enterprise environments. You’ll monitor networks, systems, and applications for indicators of compromise and use threat data to identify malicious activity and patterns.

Monitor networks, systems, and applications for indicators of compromise and analyze threat data to identify malicious activity.
Investigate security incidents by collecting and analyzing logs and artifacts, including memory and network traffic; support containment, eradication, and recovery activities.
Identify and assess vulnerabilities across systems, networks, and applications, then recommend remediation actions based on risk and exploitability.
Analyze malware, exploits, and adversary tools, including reverse engineering malicious code and simulating adversary techniques in controlled environments.
Produce technical reports, briefings, and documentation that summarize findings, methodologies, and recommendations for stakeholders.

Skills and qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
Active Top-Secret Clearance.
2+ years of experience in cyber exploitation analysis, threat intelligence, or incident response.
Experience analyzing advanced persistent threats (APTs), malware, exploitation techniques, and reverse engineering tools such as IDA Pro or Ghidra.
Experience performing vulnerability assessments, penetration testing, or red team activities.
Hands-on experience with network traffic analysis, log analysis, and digital forensics, including Windows, Linux, and macOS, common network protocols, and scripting languages such as Python, PowerShell, or Bash.
Experience with security monitoring tools such as SIEM, IDS, IPS, and EDR.
Ability to travel up to 20% on average based on work, clients, and industries/sectors served.
Ability to work at client onsite or a Deloitte office for up to 5 days a week.
Must have industry certifications such as GIAC, CISSP, or CompTIA Security+ (required).
Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Preferred qualifications

Experience supporting incident response in government, defense, intelligence, or large enterprise environments.
Experience analyzing packet captures, memory dumps, and host-based forensic artifacts.
Experience mapping threat activity to the MITRE ATT&CK framework.
Experience developing or tuning detections for SIEM or EDR platforms.
Industry certifications such as GIAC, CISSP, or CompTIA Security+.

Technologies you may work with

IDA Pro, Ghidra, Python, PowerShell, Bash
SIEM, IDS, IPS, EDR
Windows, Linux, macOS
MITRE ATT&CK, Global Information Assurance Certification (GIAC), Certified Information Systems Security Professional (CISSP), CompTIA Security+

Location: Baltimore, MD (onsite)
Compensation: USD 102,500 - 188,900 per year

View full job page →

1mo ago

Senior Cybersecurity Engineer

Nexigen Newport, KY

Newport, KY

1mo ago Closed

$90k - $115k/yr Full time Senior Application Security Cyber Forensics

This position is no longer accepting applications (closed Sep 5, 2026).

Job Description

Nexigen is hiring a Senior Cybersecurity Engineer to provide hands-on leadership across digital forensics, penetration testing, and compliance support. Based in Newport, KY, this hybrid role blends incident investigation and control mapping with direct technical involvement on client engagements, including support for sales calls, proposals, and RFP responses.

The position focuses on reconstructing attacks from evidence, validating security posture through real-world testing, and producing clear results that stand up to technical, legal, and executive scrutiny. You will also help keep compliance artifacts current and support audit and certification activities across multiple frameworks as applicable.

What you’ll do

Lead forensic investigations of security incidents, including evidence acquisition, chain-of-custody documentation, and root-cause analysis.
Analyze compromised systems, network traffic, and logs to reconstruct attack timelines and identify indicators of compromise.
Produce clear, defensible incident reports for technical, legal, and executive audiences.
Plan and execute penetration tests and vulnerability assessments across networks, applications, and cloud environments.
Simulate real-world attack techniques to identify exploitable weaknesses before adversaries do.
Deliver findings with prioritized, actionable remediation guidance for internal teams and clients.
Support audits and certification efforts for frameworks such as SOC 2, ISO 27001, NIST, HIPAA, or PCI DSS as applicable.
Maintain security policies, control documentation, and evidence for internal and external audits.
Track remediation of compliance gaps and advise stakeholders on regulatory risk.
Provide support to internal teams and Nexigen’s clients on cyber security related topics and engagements.
Serve as a technical subject-matter expert during client and prospect calls, translating security capabilities into business value.
Contribute to proposals, RFP responses, and security questionnaires with accurate technical content.
Partner with the sales team to scope security engagements and set realistic client expectations.

Required qualifications

5+ years of experience in cyber security, including direct experience in forensics and penetration testing.
Bachelor’s degree in Cyber Security or a related Computer Science or Information Systems degree (listed as “Batchlor’s degree” in the source).
Working knowledge of at least one major compliance framework: SOC 2, ISO 27001, CMMC, NIST 800-171, or NIST 800-53.
Hands-on experience using forensic and penetration testing tools including EnCase, FTK, Autopsy, Burp Suite, Metasploit, and Nmap.
Strong written and verbal communication skills, with the ability to explain technical risk to non-technical audiences.
Strong understanding of advanced networking and secure network architecture including 802.1x, Radius Configurations, and MFA.
Sound judgment and discretion when handling sensitive investigations and client data.
Strong problem-solving skills and the ability to stay calm and methodical under incident-response pressure.
Ability to collaborate across engineering, legal, and sales stakeholders.
Self-motivated with the ability to manage multiple engagements and priorities independently.
Client-facing comfort building trust and rapport with prospects and customers.
Comfort engaging directly with clients or prospects in a pre-sales or advisory capacity.

Additional skills and working requirements

Interpersonal skills including telephony skills, communication skills, active listening, and customer-care.
Diagnosis skills of technical issues, ability to multi-task and adapt quickly, and technical awareness for matching resources to technical issues appropriately.
Service awareness of key IT services being supported, including understanding support tools and how technology is used to provide IT services.
Typing skills for quick and accurate entry of service request details, requiring finger and wrist dexterity in repetitive motion.
Must be able to remain in a stationary position 80% of the working day; occasionally move within the office and up and down stairs to access hardware storage rooms and office machinery.
Frequently position self to maintain computers in the lab, including under desks and in the server closet.
Frequently communicate with co-workers, clients, and contractors, exchanging accurate information.
Must be able to detect and/or recognize software, hardware, and operating systems used on or to operate computers.

Salary and location

Location: Newport, KY (hybrid)
Compensation: USD 90,000 - 115,000 per year

Tools and frameworks

Forensics and testing: EnCase, FTK, Autopsy, Burp Suite, Metasploit, Nmap
Compliance and standards: SOC 2, ISO 27001, NIST, CMMC, NIST 800-171, NIST 800-53, HIPAA, PCI DSS
Networking and identity: 802.1x, Radius Configurations, MFA
Certifications mentioned: GCFA, GCFE, OSCP, CEH, CISSP, CISA

Benefits

401(k) and 401(k) matching
Dental insurance
Health insurance
Life insurance
Paid time off
Referral program
Vision insurance

View full job page →

Cyber Investigations Engineer Jobs

Security Engineer III, Exploitation Analyst / Incident Responder

Senior Cybersecurity Engineer

Get Cyber Investigations Engineer Jobs alerts