Cybersecurity · Work role code 212
Cyber Defense Forensics Analyst
Analyzes digital evidence and investigates computer security incidents to derive useful information in support of system/network vulnerability mitigation.
From DoD DCWF Tool v5.3 (2026-09-25)
Tasks
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 438ACollect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.Core
- 447Conduct analysis of log files, evidence, and other information in order to determine best methods for identifying the perpetrator(s) of a network intrusion.Core
- 463Confirm what is known about an intrusion and discover new information, if possible, after identifying intrusion via dynamic analysis.Core
- 480Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is not unintentionally modified, to use for data recovery and analysis processes. This includes, but is not limited to, hard drives, floppy diskettes, CD, PDA, mobile phones, GPS, and all tape formats.Additional
- 482Decrypt seized data using technical means.Additional
- 541Provide technical summary of findings in accordance with established reporting procedures.Core
- 573Ensure chain of custody is followed for all digital media acquired in accordance with the Federal Rules of Evidence.Additional
- 613Examine recovered data for information of relevance to the issue at hand.Core
- 636Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration.Additional
- 749Perform dynamic analysis to boot an “image” of a drive (without necessarily having the original drive) to see the intrusion as the user may have seen it, in a native environment.Additional
- 752Perform file signature analysis.Core
- 753Perform hash comparison against established database.Additional
- 758Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView).Additional
- 759Perform timeline analysis.Additional
- 762Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs).Additional
- 768Perform static media analysis.Additional
- 771Perform tier 1, 2, and 3 malware analysis.Additional
- 786Prepare digital media for imaging by ensuring data integrity (e.g., write blockers in accordance with standard operating procedures).Additional
- 817Provide technical assistance on digital evidence matters to appropriate personnel.Additional
- 825Recognize and accurately report forensic artifacts indicative of a particular operating system.Additional
- 839AReview forensic images and other data sources (e.g., volatile data) for recovery of potentially relevant information.Additional
- 868AUse data carving techniques (e.g., FTK-Foremost) to extract data for further analysis.Additional
- 870Capture and analyze network traffic associated with malicious activities using network monitoring tools.Additional
- 871Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.Additional
- 882AWrite and publish cyber defense recommendations, reports, and white papers on incident findings to appropriate constituencies.Additional
- 944Conduct cursory binary analysis.Additional
- 1031Serve as technical expert and liaison to law enforcement personnel and explain incident details as required.Additional
- 1081Perform virus scanning on digital media.Additional
- 1082Perform file system forensic analysis.Core
- 1083Perform static analysis to mount an "image" of a drive (without necessarily having the original drive).Additional
- 1084Perform static malware analysis.Additional
- 1085Utilize deployable forensics tool kit to support operations as necessary.Additional
- 2179Coordinate with intelligence analysts to correlate threat assessment data.Additional
- 5690Process image with appropriate tools depending on analyst’s goals.Additional
- 5700Perform Windows registry analysis.Additional
- 5720Perform file and registry monitoring on the running system after identifying intrusion via dynamic analysis.Additional
- 5730Enter media information into tracking database (e.g., Product Tracker Tool) for digital media that has been acquired.Additional
- 5740Correlate incident data and perform cyber defense reporting.Additional
- 5760Maintain deployable cyber defense toolkit (e.g., specialized cyber defense software/hardware) to support IRT mission.Additional
Knowledge
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
- 24AKnowledge of basic concepts and practices of processing digital forensic data.Core
- 25Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).Additional
- 29Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.Additional
- 61Knowledge of incident response and handling methodologies.Additional
- 90Knowledge of operating systems.Additional
- 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Additional
- 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
- 113Knowledge of server and client operating systems.Additional
- 114Knowledge of server diagnostic tools and fault identification techniques.Additional
- 139Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.Additional
- 264Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).Additional
- 287Knowledge of file system implementations (e.g., New Technology File System [NTFS], File Allocation Table [FAT], Extended File System [EXT]).Additional
- 290Knowledge of processes for seizing and preserving digital evidence (e.g., chain of custody).Additional
- 294Knowledge of hacking methodologies in Windows or Unix/Linux environment.Additional
- 302Knowledge of investigative implications of hardware, Operating Systems, and network technologies.Core
- 310Knowledge of legal governance related to admissibility (e.g., Federal Rules of Evidence).Additional
- 316Knowledge of processes for collecting, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.Additional
- 340Knowledge of types and collection of persistent data.Additional
- 345Knowledge of web mail collection, searching/analyzing techniques, tools, and cookies.Additional
- 346Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.Additional
- 888Knowledge of types of digital forensics data and how to recognize them.Additional
- 889Knowledge of deployable forensics.Additional
- 923Knowledge of security event correlation tools.Additional
- 982Knowledge of electronic evidence law.Additional
- 983Knowledge of legal rules of evidence and court procedure.Additional
- 1033Knowledge of basic system administration, network, and operating system hardening techniques.Additional
- 1036Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.Additional
- 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Additional
- 1086Knowledge of data carving tools and techniques (e.g., Foremost).Core
- 1089Knowledge of reverse engineering concepts.Core
- 1092Knowledge of anti-forensics tactics, techniques, and procedures.Core
- 1093Knowledge of common forensics tool configuration and support applications (e.g., VMware, WIRESHARK).Additional
- 1094Knowledge of debugging procedures and tools.Additional
- 1095Knowledge of how different file types can be used for anomalous behavior.Additional
- 1096Knowledge of malware analysis tools (e.g., OllyDbg, Ida Pro, Ghidra).Core
- 1097Knowledge of virtual machine aware malware, debugger aware malware, and packing.Additional
- 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
- 1158* Knowledge of cybersecurity principles.Core
- 1159* Knowledge of cyber threats and vulnerabilities.Core
- 3461Knowledge of relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.Additional
- 3513Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.Additional
- 6210Knowledge of cloud service models and possible limitations for an incident response.Additional
- 6810Knowledge of binary analysis.Core
- 6820Knowledge of network architecture concepts including topology, protocols, and components.Additional
- 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
- 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
- 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
- 7111* Knowledge of Zero Trust Security Model Principles.Core
Skills
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 193Skill in developing, testing, and implementing network infrastructure contingency and recovery plans.Additional
- 214ASkill in performing packet-level analysis.Additional
- 217Skill in preserving evidence integrity according to standard operating procedures or national standards.Core
- 350Skill in analyzing memory dumps to extract information.Core
- 360Skill in identifying and extracting data of forensic interest in diverse media (i.e., media forensics).Additional
- 364Skill in identifying, modifying, and manipulating applicable system components within Windows, Unix, or Linux (e.g., passwords, user accounts, files).Additional
- 369Skill in collecting, processing, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.Additional
- 374Skill in setting up a forensic workstation.Additional
- 381Skill in using forensic tool suites (e.g., EnCase, Sleuthkit, FTK).Core
- 386Skill in using virtual machines.Additional
- 389Skill in physically disassembling PCs.Additional
- 890Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).Core
- 1087Skill in deep analysis of captured malicious code (e.g., malware forensics).Core
- 1088Skill in using binary analysis tools (e.g., Hexedit, command code xxd, hexdump).Core
- 1091Skill in one way hash functions (e.g., Secure Hash Algorithm [SHA], Message Digest Algorithm [MD5]).Additional
- 1098Skill in analyzing anomalous code as malicious or benign.Core
- 1099Skill in analyzing volatile data.Core
- 1100Skill in identifying obfuscation techniques.Core
- 1101Skill in interpreting results of debugger to ascertain tactics, techniques, and procedures.Core
- 6850Skill in analyzing malware.Core
- 6860Skill in conducting bit-level analysis.Core
- 6870Skill in processing digital evidence, to include protecting and making legally sound copies of evidence.Core
Abilities
From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id
Free · DoD DCWF Tool v5.3 (2026-09-25)- 908Ability to decrypt digital data collections.Additional
- 6890Ability to conduct forensic analyses in and for both Windows and Unix/Linux environments.Core
Workforce Automation analysis, not part of the source
O*NET jobs
WFA · Part of the paid plan when accounts openJobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.
- Information Security Analysts 15-1212.00 · through PD-WRL-002DWAs covered10 of 10
- Fraud Examiners, Investigators and Analysts 13-2099.04 · through PD-WRL-002DWAs covered3 of 21
- Digital Forensics Analysts 15-1299.06 · through PD-WRL-002DWAs covered1 of 20
- Forensic Science Technicians 19-4092.00 · through PD-WRL-002DWAs covered0 of 20
Equivalents
NICE work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles
Free · DoD DCWF Tool v5.3 (2026-09-25)- Digital Forensics PD-WRL-002 · linked by DCWF Tool NCWF ID
O*NET jobs it reaches
Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Information Security Analysts 15-1212.00 · through PD-WRL-002
- Fraud Examiners, Investigators and Analysts 13-2099.04 · through PD-WRL-002
- Digital Forensics Analysts 15-1299.06 · through PD-WRL-002
- Forensic Science Technicians 19-4092.00 · through PD-WRL-002