Cyber Forensic Examiner - Entry Level

Minimum Qualifications: The Entry-Level Cyber Forensic Examiner supports digital forensic investigations involving computers, mobile devices, storage media, network data, cloud environments, and other digital evidence. The examiner assists with evidence identification, preservation, acquisition, examination, and analysis in accordance with established forensic procedures and applicable legal, regulatory, and organizational requirements.

Responsibilities: Support digital forensic examinations of computers, servers, mobile devices, removable media, virtual machines, cloud environments, and other digital systems. Assist with the identification, preservation, collection, and acquisition of digital evidence while maintaining evidence integrity and chain of custody. Perform forensic imaging and data acquisition using approved forensic methodologies and tools. Assist in recovering deleted, hidden, encrypted, or otherwise obscured data when technically feasible. Conduct basic timeline analysis and correlate artifacts from multiple sources to reconstruct user and system activity. Support mobile-device forensic examinations and analysis of mobile application and communications artifacts. Assist with analysis of network, cloud, and enterprise-system data when relevant to an investigation. Use forensic tools and utilities to search, filter, recover, and analyze digital evidence. Document examination procedures, findings, evidence sources, and analytical conclusions. Prepare technical notes, evidence inventories, examination records, and draft forensic reports. Maintain strict evidence-handling, security, confidentiality, and chain-of-custody procedures. Assist senior examiners with investigations involving cybersecurity incidents, insider activity, unauthorized access, fraud, data loss, and other computer-related events. Maintain awareness of emerging forensic techniques, operating systems, applications, devices, and digital artifacts.