All courses
Resource hub
Featured resource
Tech Upskilling Playbook 2025
Tech Upskilling Playbook

Build future-ready tech teams and hit key business milestones with seven proven plays from industry leaders.

Learn more
Hamburger Icon
  • Path icon Learning Path
    • Libraries: This path is only available in the libraries listed. To access this path, purchase a license for the corresponding library.
  • Cloud
  • Security
    •

Cyber Defense Forensics Analyst | Work Role ID: 212 (NIST: PD-WRL-002)

29 Courses
9 Labs
48 Hours
Skill IQ

A **cyber defense forensic analyst** analyzes digital evidence and investigates computer security incidents to derive useful information in support of system/network vulnerability mitigation.

This path will get you started on your journey to becoming an cyber defense forensic analyst! Begin with the fundamental concepts of networking and incident handling through hands-on labs, dive into the essential skills necessary to perform the day-to-day functions of a cyber defense forensic analyst and then expand your skill set with, automation, deeper/advanced concepts and additional knowledge from adjacent roles!

This path aligns to the Knowledge, Skills, Abilities and Tasks (KSAs) within the **Workforce Framework for Cybersecurity (CSWF)** and the **DoD Cyber Workforce Framework (DCWF)** for the work role of:

**Cyber Defense Forensics Analyst** Work Role 212 or PD-WRL-002

Get started

Content in this path

Fundamentals

Begin your learning journey with the fundamental concepts of networking and security!

Course

Windows Endpoint Security: Logs

  • by Michael Teske
  • 28m
  • Nov 29, 2023
Lab

Windows Endpoint Security: Logs

  • by Michael Teske
  • 2h 35m
  • Aug 04, 2025
Lab

Linux Endpoint Security: Logs

  • by Aaron Rosenmund
  • 2h 20m
  • Aug 04, 2025
Lab

Linux Endpoint Security: Networking

  • by Aaron Rosenmund
  • 2h 5m
  • Aug 04, 2025
Course

Windows Endpoint Security: Networking

  • by Michael Teske
  • 21m
  • Jan 13, 2023
Lab

Windows Endpoint Security: Networking

  • by Michael Teske
  • 1h 55m
  • Aug 05, 2025
Course

Incident Response: Detection and Analysis

  • by Aaron Rosenmund
  • 2h 19m
  • Dec 16, 2021
Course

Incident Response: Containment, Eradication and Recovery

  • by Aaron Rosenmund
  • 1h 6m
  • May 12, 2023
Course

Malware Analysis Fundamentals

  • by Tyler Hudak
  • 3h 20m
  • May 05, 2017
Course

Incident Forensics: Digital Media Acquisition

  • by Ricardo Reimao
  • 1h 31m
  • Jul 26, 2019
Course

IT Security Champion: Cyber Threat Intel and Emerging Threats

  • by Christopher Rees
  • 16m
  • Feb 29, 2024

Skill Essentials

Now that you know the fundamentals, dive into the essential skills necessary to perform the day-to-day functions of a cyber defense forensic analyst including malware analysis, reverse engineering, and specialized incident response!

Course

Security Engineering: Secure Networks

  • by Chris Jackson
  • 1h 43m
  • Aug 13, 2024
Course

Specialized Engineering: Enterprise Hybrid Cloud

  • by Michael Brown
  • 1h 9m
  • Dec 05, 2022
Course

Incident Response: Network Analysis

  • by Brandon DeVault
  • 1h 10m
  • Mar 09, 2022
Course

Specialized DFIR: Windows Event Log Forensics

  • by Tyler Hudak
  • 38m
  • Dec 12, 2023
Course

Specialized DFIR: Windows Registry Forensics

  • by Tyler Hudak
  • 1h 10m
  • Apr 13, 2023
Course

Specialized DFIR: Windows File System and Browser Forensics

  • by Tyler Hudak
  • 54m
  • Sep 25, 2023
Course

Defense Evasion with Invoke-Obfuscation

  • by Ricardo Reimao
  • 24m
  • Jul 31, 2025
Lab

Lab - Defense Evasion with Invoke-Obfuscation

  • by Zach Roof
  • 2h 45m
  • Aug 04, 2025

Expanded Skillset

It's time to expand your skill set with tools, and more advanced concepts!

This section gives you a brief introduction into many, additional skills that you will find helpful as an cyber defense forensic analyst. We have full training paths on all of these skills; see the Supplemental Skill Paths section to learn more.

Course

OS Analysis with The Sleuth Kit & Autopsy

  • by Ashley Pearson
  • 15m
  • Sep 30, 2021
Course

AccessData Forensic Toolkit (FTK) Imager

  • by Phil Chapman
  • 1h 27m
  • Oct 11, 2024
Course

Advanced Cyber Defense Analysis with Wireshark

  • by Sean Wilkins
  • 2h 31m
  • Jan 26, 2023
Course

Malware Analysis: Assembly Basics

  • by Josh Stroschein
  • 1h 28m
  • Jul 03, 2024
Lab

Malware Analysis: Debugging and Reverse Engineering

  • by Shimon Brathwaite
  • 45m
  • Jul 30, 2025
Course

Ghidra Concepts and Basic Functionality

  • by Josh Stroschein
  • 43m
  • Aug 15, 2024
Course

IDA Pro Concepts and Basic Functionality

  • by Josh Stroschein
  • 1h 6m
  • Mar 02, 2023
Course

Detecting Anomalies and Events with Metricbeat

  • by Sean Wilkins
  • 22m
  • Jan 24, 2025
Lab

Threat Heatmap Visualization

  • by Antonio Jesús Piedra
  • 1h
  • Aug 05, 2025
Course

Network Security Monitoring with Suricata

  • by Kevin James
  • 1h 14m
  • Dec 06, 2024

Adjacent Skill Knowledge

Now that you've mastered all the skills for a cyber defense forensic analyst, learn about additional cyber roles and their responsibilities.

Course

Cryptography for SSCP®

  • by Dr. Lyron H. Andrews
  • 1h 49m
  • Oct 11, 2024
Course

Information and Cyber Security Literacy: Governance, Risk, and Compliance

  • by John Elliott
  • 59m
  • Dec 14, 2022
Course

Information and Cyber Security GRC: Governance

  • by Dominique West
  • 1h
  • Nov 09, 2023
Course

Information and Cyber Security GRC: Risk Management

  • 1h 36m
  • Feb 27, 2024
Course

Legal and Ethical Considerations for Digital Forensics

  • by Bobby Rogers
  • 2h 11m
  • Aug 04, 2025
Course

Sandworm: C2 over HTTP Emulation

  • by Matthew Lloyd Davies
  • 5m
  • Nov 12, 2024
Lab

Sandworm: C2 over HTTP Emulation Lab

  • by Matthew Lloyd Davies
  • 55m
  • Aug 05, 2025
Course

Sandworm: Keylogging Emulation

  • by Matthew Lloyd Davies
  • 5m
  • Nov 18, 2024
Lab

Sandworm: Keylogging Emulation Lab

  • by Matthew Lloyd Davies
  • 30m
  • Jul 30, 2025
Try this learning path for free
Access this learning path and other top-rated tech content with a free trial.
Free individual trial Free team trial
What You'll Learn
Prerequisites
  • None
Related topics
  • dcwf
  • cswf
  • nice framework
  • Cyber Defense Infrastructure Support Specialist
Not sure where to start?
With over 500 assessments to choose from, you can see where your skills stand and receive adaptive learning recommendations to fill knowledge gaps in as little as 10 minutes.
Learn more

Learn with the best

Michael Teske
Michael Teske
Michael Teske is a principal security author with Pluralsight helping people build their skills toolkit. Michael has 25+ years of experience in the IT Ops/Cloud/Cybersecurity industry including 17 of those years as an IT instructor at a technical college, focusing on Microsoft server infrastructure, security and automation. Michael attained his MBA with an emphasis in Computer Information System Security several years ago. Michael still keeps up with the industry as an independent consultant in ...
Aaron Rosenmund
Aaron Rosenmund
Aaron M. Rosenmund is a cyber security operations subject matter expert, with a background in federal and business defensive and offensive cyber operations and system automation. Leveraging his administration and automation experience, Aaron actively contributes to multiple open and closed source security operation platform projects and continues to create tools and content to benefit the community. As an educator & cyber security researcher at Pluralsight, he is focused on advancing cyber secur...
Tyler Hudak
Tyler Hudak
Tyler Hudak has more than 15 years of extensive real-world experience in incident handling, malware analysis, computer forensics, and information security for multiple Fortune 500 firms. He has spoken and taught at a number of security conferences on the topics of malware analysis, incident response, and penetration testing, and brings his frontl ine experience and proven techniques to bear in his training.
Ricardo Reimao
Ricardo Reimao
Ricardo is a Cybersecurity Consultant based in Toronto (Canada). He has 14+ years of IT experience, 10 of them in the IT Security field. His main interests are: SIEM solutions (IBM QRadar), Enterprise Security Risk, Penetration Testing, Security processes/procedures and Network Security.
Christopher Rees
Christopher Rees
Chris is a professional information technologist, author, trainer, manager and a lifelong learner. He is married with 3 beautiful children and interested in working out, spending time with family and friends and being creative whenever possible. He has been an author for over 25 years and has created over 60 IT Certification training courses. Chris really enjoys helping people advance in their careers through training and personal development.
Chris Jackson
Chris Jackson
Chris Jackson is a cybersecurity professional with years of experience in identifying security incidents, securing applications and security training. Over the years, he has tested web applications for vulnerabilities, helped deploy SIEM platforms and more. He is passionate about teaching cybersecurity and committed to learning new technologies.
Michael Brown
Michael Brown
I have worked in IT for 25 years, for 22 of those years I have delivered IT Training. I have delivered Microsoft, CISCO and Amazon Web Services courses across Europe. For the last 4 years I have focused on Cloud technologies delivering cloud training to some of Europe’s biggest organisations. I have been a Microsoft Certified Trainer since 1997 and currently hold certifications from Microsoft, CompTIA and AWS. When not working on training material or delivering courses I spend time in the nort...
Brandon DeVault
Brandon DeVault
Brandon DeVault is a Security Researcher focused on threat hunting at CrowdStrike. He is also a member of the Florida Air National Guard with a variety of offensive and defensive experience. Prior to joining CrowdStrike, Brandon worked full-time as an author with Pluralsight and at Elastic, creating and delivering security content. He also worked with Special Operations Command, where he had two deployments to Afghanistan on deployable communications teams. His experience spans incident response...
Zach Roof
Zach Roof
Zach describes himself as “an ordinary guy who’s extraordinarily curious about technology.” This curiosity has led to roles in Software Development, Application Security, DevOps, and Security Engineering. Currently, Zach is the Lead Security Engineer at Credible where he helps lead the security vision of a highly sensitive Fintech product. Outside of his day job, Zach has spoken at SyntaxCon, created cybersecurity tutorials through Securing The Stack, led an AWS Meetup group, and has provided cy...
Ashley Pearson
Ashley Pearson
Ashley Pearson is a former system administrator turned threat hunter. She has spent the past 3 years of her 8+ year IT career specializing in cyber security. She currently works as a threat hunter and occasional incident responder or forensic analyst. She continues to feed her passion by actively participating in the InfoSec community, attending conferences, and pursuing higher education. Outside of work, Ashley enjoys running, video games, and reading.
Phil Chapman
Phil Chapman
Phil Chapman is a senior instructor. He is responsible for the delivery of a range of courses including official Microsoft, CompTIA, EC Council and BCS official certifications. He is also the subject matter expert and project lead for the bespoke Law Enforcement Cyber Security training packages which are delivered to UK Law Enforcement agencies and forces. He holds a variety of IT Technical and Security qualifications across many fields. Phil spent 23 years in the Royal Air Force as an Intellige...
Sean Wilkins
Sean Wilkins
Sean Wilkins, with over two decades of experience in the IT industry, serves as a distinguished networking consultant and contributor at Tech Building Blocks. His professional journey spans multiple prominent enterprises, underlining his extensive field expertise. Sean's credentials include esteemed certifications from Cisco (CCNP/CCDP), Microsoft (MCSE), and CompTIA (A+ and Network+). Academically, he has achieved a Master’s of Science in Information Technology, specializing in Network Architec...
Josh Stroschein
Josh Stroschein
Josh is an experienced malware analyst and reverse engineer and has a passion for sharing his knowledge with others. He is a reverse engineer with the FLARE team at Google, where he focuses on tackling the latest threats. Josh is an accomplished trainer, providing training at places such as Ring Zero, BlackHat, Defcon, Toorcon, Hack-In-The-Box, Suricon, and other public and private venues. Josh is also an author on Pluralsight, where he publishes content around malware analysis, reverse engineer...
Shimon Brathwaite
Shimon Brathwaite
Shimon Brathwaite is a seven-year cybersecurity professional with extensive experience in Incident Response, Vulnerability Management, Identity and Access Management and Consulting. He has worked at one of the Big Four consulting firms, multiple of Canada’s largest banks and in startup environments. In addition to his full-time work, he runs a blog securitymadesimple.org, a consulting company and is a published author with four books on cybersecurity. He is open for engagements related to cybers...
Antonio Jesús Piedra
Antonio Jesús Piedra
Antonio is a DevOps Engineer who loves to experiment with cutting-edge technologies. He is a Certified Kubernetes Administrator, Application Developer and Security Specialist. Antonio likes to understand the end-to-end process and he is frequently involved in design reviews, Python development, creating Docker images, writing pipelines or building Kubernetes clusters at home using Raspberry Pi’s. In addition to his passion for technology, Antonio enjoys hiking and DIY projects.
Kevin James
Kevin James
As a seasoned technologist with over 30 years of wide-ranging expertise in information technology roles across diverse industries, Kevin is passionate about finding effective and economical solutions to business problems. His passion for teaching technical subjects allows him to have a particular style that imparts information yet teaches at the same time. He enjoys working with Linux, Unix and Windows Operating Systems and combined with a deep knowledge of software platforms as varied as Ap...
Dr. Lyron H. Andrews
Dr. Lyron H. Andrews
Dr. Andrews’ technology career spans three decades. His roles included network manager New York City Department of Education, BMG Direct senior director of IT, and BNY Mellon dean of technology. His doctoral research at Teachers College Columbia found that critical thinking skills thrive in environments that are supportive of five essential elements in the mind of a critical thinker. He teaches cyber security. He has integrated technology management with teaching at Columbia University and other...
John Elliott
John Elliott
John Elliott is a specialist in regulated security and data protection. His fascination is the way that people engage with security directives: whether that’s a company following external regulation, an information security team developing policies, an IT team following them, or a colleague who is just trying to do their job securely. John has led information security and data protection functions in aviation and financial services. He’s represented both Visa Europe and Mastercard on the PCI S...
Dominique West
Dominique West
With 10 years in the Technology industry, Dominique West currently manages Datadog's compliance management function within the Information Security Department. As a leader, she is responsible for maintaining and executing the regulatory compliance roadmap, ensuring that it supports the business, sales and revenue objectives while maintaining alliance with existing information security standards. Prior to her time at Datadog, Dominique worked for as a Senior Cloud Security Consultant for Ernst ...
Bobby Rogers
Bobby Rogers
Bobby E. Rogers is an information security engineer working as a contractor for Department of Defense agencies, helping to secure, certify, and accredit their information systems. His duties include information system security engineering, risk management, and certification and accreditation efforts. He retired after 21 years in the U.S. Air Force, serving as a network security engineer and instructor, and has secured networks all over the world. Bobby has a master’s degree in information assura...
Matthew Lloyd Davies
Matthew Lloyd Davies
Matt is a cyber security author and researcher here at Pluralsight. A certified penetration tester and incident handler, he created Pluralsight's CompTIA Pentest+ Specialized Attacks courses as well our courses on wireless, ICS/OT and hardware hacking. Matt has also helped to build our security labs portfolio; labs that help you get hands-on to understand the threats and vulnerabilities your organization faces today. With a background in Chemical Engineering, Matt's focus is on the security ...

Join our learners and upskill
in leading technologies