NetWitness Security Engineer- Packet Capture- HHS STIM

Packet Capture (NetWitness)

Job Overview

Responsibilities

• Serve as the enterprise expert on RSA NetWitness and other packet capture/forensics platforms.
• Conduct packet capture and traffic analysis for threat detection, forensic investigation, and incident response.
• Support integration of packet capture systems with SIEM and SOC workflows.
• Develop and tune packet capture policies, filters, and monitoring rules to optimize visibility.
• Analyze network traffic to identify Indicators of Compromise (IOCs), malware activity, and anomalous behaviors.
• Provide forensic reporting and technical recommendations to stakeholders and leadership.
• Mentor and train junior analysts in packet capture and forensic investigation techniques.
• Ensure compliance with NIST SP 800-61, NIST SP 800-53 Rev. 5, and DISA STIGs.

Required Experience

• 10+ years of IT security engineering and analysis experience.
• Extensive hands-on expertise with RSA NetWitness or comparable packet capture tools.
• Experience in network forensics, intrusion detection, and advanced traffic analysis.
• Proven ability to support incident response teams and forensic investigations.
• Experience leading packet capture engineering initiatives in federal environments.

Education & Certifications

• Bachelor’s degree in Information Security, Computer Science, or related field (Master’s preferred).
• GIAC Certified Intrusion Analyst (GCIA) and/or GIAC Network Forensic Analyst (GNFA) certification required.
• Additional certifications such as CISSP, CEH, or CompTIA CySA+ are highly desirable.

Clearance Requirement

Location

• Washington, D.C. Metro Area (hybrid/onsite support as required).