Cyber Network Defense Analyst; CNDA – Cloud Forensics

Position Overview

Cyber Network Defense Analyst (CNDA) – Cloud Forensics
Location: Remote / Onsite (as required)

Clearance:

Company:

Argo Cyber Systems delivers advanced cybersecurity and threat-hunting capabilities to safeguard federal and critical infrastructure environments. We combine mission experience with innovation to empower our customers to detect, disrupt, and defeat adversaries in real time. Argo Cyber Systems is seeking Cyber Network Defense Analysts (CNDA) with deep Cloud Forensics expertise to support a high-visibility federal mission. In this role, you will lead advanced investigations into sophisticated intrusions across hybrid and multi‑cloud environments, identifying attacker tactics, techniques, and procedures (TTPs), correlating artifacts, and driving containment and remediation actions in partnership with government cyber teams.

Salary: $130000 - $160000 per year

Key Responsibilities

• Conduct end-to-end forensic acquisition and analysis across on‑premises, cloud, and hybrid environments (Azure AD/Entra, M365, AWS, GCP, SaaS).
• Investigate identity‑based and credential‑abuse incidents targeting cloud control planes and hybrid identity infrastructure.
• Correlate cloud telemetry (Azure Activity Logs, AWS Cloud Trail, GCP Logs, VPC Flow Logs) and network evidence to reconstruct attacker timelines and validate indicators of compromise (IOCs).
• Develop and deploy automated detection logic, threat‑hunting scripts, and analytical playbooks using Microsoft Sentinel, Defender, AWS Guard Duty, and GCP Chronicle.
• Produce comprehensive technical and executive‑level reports, integrating findings across endpoints, networks, and cloud assets to inform threat containment and strategic recommendations.
• Support continuous improvement of incident response procedures, forensics workflows, and threat‑hunting operations.
• Collaborate with Argo and government stakeholders to triage alerts, assess risk, and strengthen enterprise detection and response posture.

Required Qualifications

• U.S. Citizenship and active TS/SCI clearance (with ability to obtain DHS EOD Suitability).
• Minimum 8 years of hands‑on experience conducting digital forensics and incident response (DFIR).
• Proven expertise in cloud forensics, identity security, and hybrid infrastructure defense.
• Proficiency in M365/Azure AD, AWS IAM, and SaaS investigative methodologies.
• Deep understanding of SaaS/PaaS/IaaS architectures, including common attack vectors and defensive measures.
• Skilled in evidence acquisition, volatile data capture, artifact analysis, and technical reporting.
• Education: Bachelor's Degree in Computer Science, Cybersecurity, Computer Engineering, or a related field; High School Diploma and 10+ years of directly relevant DFIR experience.

Preferred Qualifications

• Scripting and automation proficiency in Power Shell, Python, Bash, or JavaScript.
• Familiarity with Terraform, Kubernetes, Docker, Cloud Formation, or Azure Resource Manager for automation and orchestration.
• Understanding of MITRE ATT&CK for Cloud and adversary emulation techniques.
• Strong communication and collaboration skills for working across multidisciplinary teams.
• Preferred Certifications: GIAC Cloud Defender (GCLD), GCFR, GCFA, GCFE, GCIH, EnCE, CCE, CFCE, CISSP, CCSP; AWS and Microsoft security/cloud certifications (e.g., Azure Security Engineer, AWS Security Specialty).

Benefits & Perks

• At Argo, you'll be part of a mission-driven, veteran-founded cybersecurity team protecting America's most critical systems. Join us to defend, detect, and innovate at the cyber edge.