Active Exploitation Instructor

Responsibilities

• Perform duties as CO Instructor for Active Exploitation by delivering highly technical training in a military environment consisting of lectures, labs, exercises, and other delivery methods.
• Assist with developing CO training curriculum (lecture content, student/instructor guides, exams, exercises, simulations, etc.).
• Provide instruction that teaches assigned students as described in the course Program of Instruction.
• Conduct practical exercises in a laboratory environment, conduct student study hall periods, and provide tutoring/remedial instruction for up to twenty students per class.
• Incorporate/impart technical knowledge into training delivery.
• Assess student knowledge, skills, and abilities to gauge student proficiency.
• Deliver instruction via interactive synchronous and asynchronous learning activities.
• Review and analyze training materials and recommend changes.
• DoDD 8140.01/DoD 8570.01-M Level II certifications are desired but not required.

Minimum Qualifications

• Bachelor’s Degree plus two (2) years of experience in Cyberspace Operations (CO).
• Experience in CO is defined as experience in Defensive Cyberspace Operations (DCO) or Offensive Cyberspace Operations (OCO).
• In lieu of a degree, four (4) years of experience in Cyberspace Operations (CO).
• Experience in adult learning with an emphasis on providing instruction to large classes. US Military instructor certification or designation is highly desirable (e.g., teaching certificate, certified professional instructor, master training specialist, adjunct faculty certification, etc.).
• NTFS/EXT file systems (Understand file system structure and layout, understand how to navigate and search the file system for files of interest during an investigation)
• Must be able to conduct analysis (dynamic or static) on a file and identify the type of malware present, including understanding how the malware operates.
• Must be familiar with the following tools and the basic techniques used to conduct an investigation. Should be familiar with general concepts (keyword search, file system navigation, locating hidden files, file extraction, etc.): EnCase, Sleuth Kit, Helix
• Must be familiar with the following common tools used to conduct malware analysis in a static or dynamic environment. Should be familiar with common usage of the tools and be able to explain what each tool does and why it is used: Process explorer, Process monitor, Regshot, OllyDbg, IDA Pro, Wireshark
• 3-5 years as a Forensics or Malware Analyst
• GIAC Reverse Engineering Malware (GREM), Certified Reverse Engineering Analyst (CREA), EnCase, or GIAC Certified Forensic Analyst (GCFA) is desired.