JavaScript Job: Host Forensic Analyst

Are you looking to make an immediate impact where you can help our clients solve their business challenges? Deloitte's Core Business Operations (CBO) portfolio operates at the center of our client's business. By joining our team, you could help C-suite and program leaders transform their organization and accelerate mission execution through emerging and disruptive technologies, innovative business models, retooled program operations and industry-driven solutions.

Work you'll do

The host forensic analysis (HFA) team member is responsible for the analysis of all corporate IT machines in the environment. This includes forensic analysis of Windows and Linux clients and servers, timeline analysis of activity on these endpoints, user permission and authentication audits, log analysis, and malware identification/triage.

An ideal candidate for this position will have experience with system administration, Windows and Linux operating systems (OS) mechanics and filesystem structures, disk and memory forensics, commonly abused tools/vectors for persistence, privilege escalation, and lateral movement, operating system log analysis, and triaging suspicious file artifacts for unusual behavior, with respect to the environment they are found in. This role requires a familiarity with what routine OS activities and common software/user behavior looks like in the context of forensic artifacts or timelines. Analysts should also be familiar with common categories and formats of host-based indicators of compromise (IOCs) and how/where they can be leveraged to identify known-bad files/activity on an endpoint.

The primary job of the HFA team is to identify unusual files, scripts, configurations, and user activity based on bulk aggregation via an Endpoint Detection and Response (EDR) or triage tool, deployed at scale. These collected records will allow analysts to identify potentially malicious filesystem objects for deeper analysis.

Proficiency with tools such as:

• Host triage tools: Redline, KAPE, etc.
• Memory and hard drive acquisition
• Hard drive forensic analysis tools such as: Encase, Autopsy, Yara, Plaso/Log2Timeline
• Memory forensics
• Log and registry analysis
• EDR tools such as Endgame, FireEye Helix, Tanium, Carbon Black, SentinelOne, GRR, etc.
• Big data analysis platforms: Splunk, Elastic Stack, etc.
• Windows registry keys
• Windows and Linux file system artifacts
• Active directory logs for users and account permissions
• Scripts, such as web shells found on endpoints: PowerShell, PHP, Python, Bash, JavaScript
• Binary files found in the environment for malicious indicators

The team

Deloitte's Government and Public Services (GPS) practice - our people, ideas, technology and outcomes-is designed for impact. Serving federal, state, & local government clients as well as public higher education institutions, our team of over 15,000+ professionals brings fresh perspective to help clients anticipate disruption, reimagine the possible, and fulfill their mission promise.

The Systems Engineering offering is comprised of experienced professionals who help guide clients through their most complex technology challenges. This can include the delivery of large scale software applications & integrated systems, the development of service-oriented architecture (SOA) and other integrations solutions, and the delivery of technology enablement to support CIO services transformation. Our Systems Engineering offering focuses on key client issues that impact the core business, provide operational value, drive down the cost of quality, and enhance technology innovation.

Qualifications

Required:

• Active TS/SCI security clearance required
• Bachelor's degree with ten (10) years of relevant experience
• Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future

Preferred:

• Technical documentation experience
• Communication with EL as well as NFA team and ICS analysts to dig deeper into what file system artifact discoveries may also manifest in network traffic