Role tasks and responsibilities

• To collect and preserve digital data using industry-standard tools and techniques
• To assist with the provision of forensic analysis & cyber security services to our clients
• To support our Investigation teams across all regions
• To provide high quality deliverables to our clients in a timely and efficient manner
• To ensure work is defensible and to an evidential standard as appropriate for tasks
• To provide expert testimony in court as and when required
• To be innovative and creative, showing initiative in delivering day to day duties
• Must be available for international travel (up to 25% of time)
• Stay up to date with the latest digital forensic techniques, tools and trends

Requirements

Essential

• Experience of performing forensic data acquisitions, involvement in digital investigations alongside maintaining detailed contemporaneous notes
• Understanding and awareness of multiple operating systems, particularly Microsoft and Linux infrastructure and networking systems, both on-premise and in the cloud, as well as dedicated cloud services such as Microsoft 365, Azure, AWS and Google Workspace
• Previous use and/or knowledge of common computer forensic tools for data acquisition and analysis (for example, Logicube Falcon, Velociraptor, EnCase, FTK, Nuix, X-Ways, Axiom, IEF, Blacklight, Kali, WinFE, DEFT, Cellebrite, XRY)
• The ability to use PowerShell scripting, Bash scripts, Python, SQL and data wrangling for log analysis.
• Demonstrable, technical computer forensics experience/awareness of associated recognised international standards
• Good understanding of best practice procedures (NPCC, NIST, ISO17025) evidence handling, computer systems and tools of the trade
• Good understanding of both the MITRE ATT&CK and Cyber Kill chain framework, network topology and EDR solutions

Preferred

• Experience in performing mobile device acquisitions
• Wide understanding of programming/scripting skills
• Excellent presentation skills
• Experience of providing client-facing communications & consultative service
• Experience of writing expert reports and witness statements

Essential

• Excellent written/verbal communication skills
• Educated to BSc in IT or similar technical degree (or related experience)
• Knowledge of Microsoft/Apple/Linux products
• Awareness and understanding of computer networks and infrastructure

Preferred

• Educated to BSc/MSc (or equivalent) in Computer Forensics
• Forensic accreditation, for example EnCE, ACE, GCFE
• Previous internship or work experience in a DFIR/Security Operations role