Digital Forensic Examiner

The ideal candidate is an experienced and knowledgeable Digital Forensic Examiner with hands-on experience with digital forensic examinations, including the identification, collection and preservation of electronic devices, the ability to forensically acquire and analyze data from the device, as well as with conducting on-scene previewing and triaging of electronic devices and with the collection of data from digital video recording systems.   They would have the knowledge and ability to prepare and report the evidence for investigation and for prosecution purposes. They would be familiar with best practices on how to perform the above procedures.

The ideal candidate would also be able for callouts to occasionally work outside of normal business hours in order to report to crime scenes involving digital evidence, complete priority examinations and/or to assist with time sensitive evidence collection/processing.

• Performs advanced digital forensic and cybersecurity examinations, electronic discovery, and data recovery involving computers, mobile devices, digital media, networks, cloud environments, and electronic storage devices to identify, recover, preserve, and analyze evidence related to criminal and cyber investigations.

• Uses specialized forensic hardware, software, ethical hacking methods, and investigative techniques to examine devices and systems; access secured or deleted data; and analyze messages, social media activity, location information, email, internet history, databases, applications, operating systems, network activity, and other electronically stored information.

• Responds to crime scenes and cyber incidents to identify, collect, preview, inventory, transport, secure, and preserve digital evidence in accordance with forensic standards, chain-of-custody requirements, and legal admissibility requirements.

• Conducts cloud and network forensic analysis, malware and ransomware investigations, vulnerability and security assessments, and analysis of attack techniques and indicators of compromise to identify, document, and interpret evidence of criminal or unauthorized activity.

• Prepares clear, accurate, and comprehensive forensic reports and presents complex technical findings in a manner understandable to investigators, prosecutors, courts, and other nontechnical audiences.

• Collaborates with investigators, prosecutors, legal counsel, and partner agencies to provide technical and investigative assistance; support search warrants and court proceedings; research applicable laws, case law, regulations, and forensic standards; and provide expert witness testimony regarding forensic methods, findings, and conclusions.

• Provides training and technical instruction related to digital evidence, cybersecurity, and computer and mobile-device investigations; researches emerging cyber threats, tools, and technologies; manages multiple assignments and deadlines; safeguards confidential information; and performs duties that may involve exposure to child sexual abuse material and other disturbing or graphic content.

• Formal Education/Knowledge: Bachelor’s degree in criminal justice, forensic science, computer science, information systems or a related field.

• Experience: Minimum three years of experience in computer and mobile forensics

• Certifications and Other Requirements: Valid Arizona Driver’s License, or ability to obtain a valid Arizona Driver’s License, with an acceptable driving record. One or more certifications or training in digital/mobile device forensics, including IACIS (CFCE, CMDE, BCFE, MDF), NCFI (BCERT, MDE), FLETC (MDIP, DFI/SCERS), Cellebrite, Magnet/GrayKey, FTK, or GetData Forensic Explorer.

• Reading: Work requires knowledge of and ability to read State, City and other applicable statutes, and ability to read reports, correspondence, software manuals, trade journals, and policies at a college level.

• Math: Work requires the ability to perform general and advanced math calculations, such as addition, subtraction, multiplication, division, and general accounting.

• Writing: Work requires the ability to write and update policies, procedures, and guidelines; training manuals; presentations; reports; and correspondence at a college level.

• Managerial: Job has no responsibility for the direction or supervision of others, but may provide advice/direction to an employee with less experience/skills or tenure

• Policy/Decision Making: Moderate - The employee normally performs the duty assignment within broad parameters defined by general organizational requirements and accepted practices. End results determine effectiveness of job performance. This position independently decides how objectives are achieved and what resources are needed. Typical positions in this category are upper management to executive level jobs.

• Technical Skills: Limited - Work requires advanced skills and knowledge in approaches and systems, which affect the design and implementation of major programs, solutions for highly complex issues, and/or processes organization-wide. Independent judgment and decision-making abilities are necessary to apply technical skills effectively.

• Interpersonal/Human Relations Skills: Moderate – Interactions at this level typically result in recommendations regarding policy development, changes, and implementation. Interactions at this level are typically concerned with providing communications at higher levels of organizational operations and may utilize activities such as evaluating customer satisfaction, developing cooperative associations, and allocating resources to improve work operations, work quality, overall achievement of organizational goals and objectives, and customer satisfaction.

Within the first month:

1. Attend Goodyear Employee Orientation (GEO) and complete all assignments, trainings, and meetings associated with GEO.
2. Become familiar with the City’s Core Values and the Department Vision and Mission. Take the opportunity to connect your role to the big picture.
3. Become familiar with the policies and procedures related to your job function.
4. Participate in any meetings related to Digital Forensics and/or Major Crimes. 
5. Become familiar with digital forensics equipment and software that you’ll be utilizing.

Within the first 3 months:

1. Become familiar with general policies and procedures for the city and Police Department.
2. Become familiar with assisting with managing evidence within and outside of the lab.
3. Learn processes as it relates to the electronic storage lockers and faraday bags.
4. Visit ACTIC computer forensic lab and USSS forensic lab.

 Within the first 6 months:

1. Be able to provide advice and assistance in creating a more efficient lab / evidence process.
2. Show that you can be respectful, treating other investigators/technicians/co-workers with respect. Be aware, actively listen to others and seek to understand their perspective.  Seek to understand the challenges and opportunities facing digital forensics and how it interacts and supports other divisions.

Within the first 12 months:

1. Be certified in Cellebrite Software (Operator and Analyzer).
2. Be certified in Magnet Software (Graykey Operator and Axiom Analysis).
3. Be able to conduct on-scene previews, collect volatile digital evidence from running devices and collect electronic devices during ICAC and/or other types of search warrant executions.
4. Be able to assist in surveillance system data recovery.
5. Complete required city-wide trainings by the specified deadlines.
6. Attend at least one in-person Digital Forensics training.