> Markdown version of [/jobs/ext/1401425-cyber-network-defense-analyst-cnda-cloud-forensics](https://www.wearedevelopers.com/jobs/ext/1401425-cyber-network-defense-analyst-cnda-cloud-forensics). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Network Defense Analyst (CNDA) - Cloud Forensics - **Company:** Argo Cyber Systems - **Location:** Arlington, VA, United States - **Experience:** Expert - **Salary:** $130,000.0 - $160,000.0 - **Contract:** Permanent contract - **Skills:** JavaScript (Programming Language), Amazon Web Services, Microsoft Azure, Bash Shell, Software as a Service, Cloud Computing, Cyber Security, Computer Engineering, Digital Forensics, Infrastructure as a Service (IaaS), Identity and Access Management, Python (Programming Language), Network Security, Microsoft Security Essentials, Platform as a Service (PAAS), Windows PowerShell, Azure Active Directory, Google Cloud, Mitre Att&ck, Multi-Cloud, Cyber Threat Analysis, Amazon Virtual Private Cloud (VPC), Cloudformation, Kubernetes, Information Technology, Microsoft Sentinel, Terraform, Azure Resource Manager, Docker, Vulnerability Analysis - **Published:** July 23, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=98ad1d628950f013 ## About the Role * U.S. Citizenship and active TS/SCI clearance (with ability to obtain DHS EOD Suitability). * Minimum 8 years of hands-on experience conducting digital forensics and incident response (DFIR). * Proven expertise in cloud forensics, identity security, and hybrid infrastructure defense. * Proficiency in M365/Azure AD, AWS IAM, and SaaS investigative methodologies. * Deep understanding of SaaS/PaaS/IaaS architectures, including common attack vectors and defensive measures. * Skilled in evidence acquisition, volatile data capture, artifact analysis, and technical reporting., * Scripting and automation proficiency in PowerShell, Python, Bash, or JavaScript. * Familiarity with Terraform, Kubernetes, Docker, CloudFormation, or Azure Resource Manager for automation and orchestration. * Understanding of MITRE ATT&CK for Cloud and adversary emulation techniques. * Strong communication and collaboration skills for working across multidisciplinary teams., * Bachelor's Degree in Computer Science, Cybersecurity, Computer Engineering, or a related field or * High School Diploma and 10+ years of directly relevant DFIR experience. Preferred Certifications * GIAC Cloud Defender (GCLD), GCFR, GCFA, GCFE, GCIH, EnCE, CCE, CFCE, CISSP, CCSP * AWS and Microsoft security/cloud certifications (e.g., Azure Security Engineer, AWS Security Specialty) ## Description Argo Cyber Systems is seeking Cyber Network Defense Analysts (CNDA) with deep Cloud Forensics expertise to support a high-visibility federal mission. The CNDA will lead advanced investigations into sophisticated intrusions across hybrid and multi-cloud environments, identifying attacker tactics, techniques, and procedures (TTPs), correlating artifacts, and driving containment and remediation actions in partnership with government cyber teams., * Conduct end-to-end forensic acquisition and analysis across on-premises, cloud, and hybrid environments (Azure AD/Entra ID, M365, AWS, GCP, SaaS). * Investigate identity-based and credential-abuse incidents targeting cloud control planes and hybrid identity infrastructure. * Correlate cloud telemetry (Azure Activity Logs, AWS CloudTrail, GCP Logs, VPC Flow Logs) and network evidence to reconstruct attacker timelines and validate indicators of compromise (IOCs). * Develop and deploy automated detection logic, threat-hunting scripts, and analytical playbooks using Microsoft Sentinel, Defender, AWS GuardDuty, and GCP Chronicle. * Produce comprehensive technical and executive-level reports, integrating findings across endpoints, networks, and cloud assets to inform threat containment and strategic recommendations. * Support continuous improvement of incident response procedures, forensics workflows, and threat-hunting operations. * Collaborate with Argo and government stakeholders to triage alerts, assess risk, and strengthen enterprise detection and response posture. ## Related Videos - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks) - [Infrastructure as Code: The Developer's Secret Weapon](https://www.wearedevelopers.com/videos/1221-infrastructure-as-code-the-developer-s-secret-weapon) - [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered) - [MCP doesn’t suck — your agent does](https://www.wearedevelopers.com/videos/100202-mcp-doesn-t-suck-your-agent-does) - [Implementing Feature Environments with AWS and Terraform](https://www.wearedevelopers.com/videos/531-implementing-feature-environments-with-aws-and-terraform) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 162: AI careers, MCP, AWS best practices & floppy sweaters](https://www.wearedevelopers.com/magazine/571-dev-digest-162-ai-careers-mcp-aws-best-practices-floppy-sweaters) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [7 Cloud Computing Trends Coming in 2025 for Developers](https://www.wearedevelopers.com/magazine/412-7-cloud-computing-trends-coming-in-2025-for-developers)