Cyber Threat Investigator

Redhawk Federal is looking for a Cyber Investigations Analyst to become part of our Federal Strategic Cyber Group.

Location: Rosslyn, VA; full-time, on-site role.

In this role, you will:

• Support the Cyber Threat Investigations & Analysis Division (CTAD) in conducting end-to-end insider threat and cyber investigations leveraging User Activity Monitoring (UAM) tools and data.
• Collect, analyze, and interpret log data to detect anomalous user behavior, policy violations, and potential insider threats across enterprise systems.
• Develop and refine detection rules, alerts, and behavioral baselines to improve threat detection capabilities.
• Conduct forensic analysis of user activity logs, endpoint telemetry, and network data to support investigations and produce actionable intelligence.
• Communicate complex investigative findings to both technical and non-technical stakeholders, including senior management.
• Collaborate with legal, HR, and security teams to ensure investigations are conducted in accordance with applicable laws, policies, and Department guidelines.
• Author detailed investigation reports, bulletins, and advisories documenting findings.
• Promote awareness of insider threat indicators and UAM best practices among customer stakeholders, coworkers, and Department users.
• Respond to escalated security incidents and provide expert guidance on user activity-related threat vectors.
• Manage case documentation and investigative records in SharePoint repositories.
• Provide guidance and mentorship to junior team members on investigative techniques and tool usage.
• Stay current on emerging insider threat tactics, techniques, and procedures (TTPs) and incorporate findings into detection strategies.

QUALIFICATIONS

Minimum requirements:

• A Bachelor’s degree and 5 years of experience. An additional 4 years of experience may be substituted in lieu of the bachelors degree requirement.
• Minimum of 2 years experience in cybersecurity, digital forensics, or cyber investigations.
• Must either possess and maintain, or obtain prior to start date, one of the following professional certifications:
• CISSP-ISSAP; CISSP-ISSEP; CISSP; Security+ CE; CySA+; PPDA; Agile IC; SNOW App Dev
• Experience conducting insider threat or cyber misconduct investigations in an enterprise environment.
• Experience analyzing large datasets of user activity, log data, and endpoint telemetry.
• Strong analytical, problem-solving, and decision-making skills to support complex, sensitive investigations.
• Excellent written and verbal communication skills, including experience producing formal investigative reports.
• Must possess strong time management skills and the ability to complete assigned tasks with minimal supervision.
• U.S. citizenship required.
• Active Top Secret security clearance.
• Ability to obtain a final Top Secret/SCI security clearance.

Desired:

• Experience with insider threat programs and familiarity with the National Insider Threat Policy.
• Familiarity with SIEM platforms (e.g., Splunk, Microsoft Sentinel) for correlating UAM data with broader security telemetry.
• Experience with digital forensics tools (e.g., EnCase, FTK, Magnet AXIOM).
• Knowledge of Active Directory and Azure AD for user account analysis.
• Experience working in a government or federal law enforcement investigative environment.
• Technical writing skills and experience producing materials for senior leadership audiences.
• Familiarity with chain of custody procedures, and eDiscovery processes.
• Experience with behavioral analytics platforms or UEBA (User and Entity Behavior Analytics) tools.