> Markdown version of [/jobs/ext/3962609-journeyman-digital-forensics-analyst](https://www.wearedevelopers.com/jobs/ext/3962609-journeyman-digital-forensics-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Journeyman Digital/Forensics Analyst

- **Company:** ClearFocus Technologies
- **Location:** Las Vegas, NV, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Active Directory, Amazon Web Services, Proxy Servers, User Authentication, Microsoft Azure, Bash Shell, Network Analysis, Cloud Computing, Cyber Security, Computer Forensics, Linux, Digital Forensics, File Systems, Domain Name System (DNS), Elasticsearch, Internet Security, Network Packet, Python (Programming Language), Network Security, Pcap, Log Analysis, NetFlow, Network Forensics, Packet Analyzer, Windows PowerShell, CrowdStrike Falcon Management, Security Information and Event Management, TCP/IP, Wireshark, EndPointSecurity, Scripting, Office365, Mitre Att&ck, Azure Security Center, Information Technology, Cybercrime, Microsoft Sentinel, Encase, Splunk, SentinelOne Expertise
- **Published:** October 27, 2026
- **Apply:** https://www.careerbuilder.com/job-details/journeyman-digital-forensics-analyst-las-vegas-nv--3a16b023-e388-4295-bf92-e6123719f822

## About the Role

Computer Forensics, Internet Security, Government, Technical Leadership, Top Secret Clearance, Computer Forensics, Forensic Science, Security Information and Event Management (SIEM), Analysis Skills, Security Attacks, We are seeking aJourneyman Digital/Cyber Forensics Analyst foran opportunity in Las Vegas, Nevada. All applicants must have an active Top Secret clearance and bachelor or higher degree., * Experience: Minimum of 4 years of hands-on experience in digital forensics, incident response, or advanced SOC tier 2/3 operations.

 * Education: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related technical discipline (equivalent military/work experience may be substituted).
 * Clearance: Active or able to obtain a U.S. Government Top Secret clearance/Q.
 * SIEM Proficiency: Hands-on experience constructing queries, hunting, and correlating security events in SIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic Stack).
 * Forensic Tooling: Demonstrated proficiency with forensic suites and triage tools (e.g., Magnet AXIOM, EnCase, FTK, KAPE, Velociraptor, or Volatility).
 * Network Analysis: Solid understanding of TCP/IP protocols, network security architectures, and packet analysis tools (e.g., Wireshark, Zeek).

Preferred / Desired Qualifications:

 * Active GIAC certifications: GCFA (Certified Forensic Analyst), GCFE (Certified Forensic Examiner), GNFA (Network Forensic Analyst), or GCIH (Certified Incident Handler).
 * Experience with enterprise Endpoint Detection & Response (EDR) platforms (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne).
 * Experience analyzing artifacts in Windows, Linux, and cloud infrastructure (AWS, Azure, M365).
 * Familiarity with basic scripting (PowerShell, Python, or Bash) to parse artifacts or automate routine triage tasks.

## Description

We are seeking a skilled Journeyman Digital Forensics and Incident Response (DFIR) Analyst to join our team in Las Vegas, NV. In this role, you will perform deep-dive host forensics, enterprise incident triage, and large-scale network log analysis within a centralized SIEM environment to detect, investigate, and contain advanced cyber threats., * Incident Response & Host Forensics: Conduct forensic acquisitions (disk, memory, and volatile artifacts) from workstations, servers, and cloud environments in accordance with standard chain-of-custody procedures.

 * Network & SIEM Analysis: Query, correlate, and analyze multi-source logs (firewalls, proxies, DNS, Active Directory/authentication, EDR, and netflow) inside enterprise SIEM platforms to scope incidents and trace threat actor activity.
 * Timeline Reconstruction: Analyze file systems, system logs, registry hives, shellbags, prefetch, and browser history to build comprehensive intrusion timelines.
 * Network Packet Inspection: Inspect full-packet captures (PCAP) and protocol metadata (e.g., Zeek/Bro) to identify command-and-control (C2) traffic, lateral movement, and data exfiltration.
 * Adversary Mapping: Map adversary behavior to the MITRE ATT&CK framework and extract Indicators of Compromise (IOCs) for threat hunting and detection engineering.
 * Reporting & Briefing: Author detailed forensic investigation reports, root-cause analyses, and technical summaries for technical teams and leadership. Support legal proceedings or law enforcement escalation when required.