Responsibilities

This highly analytical Cryptologist should specialize in data recovery and device access to directly support law enforcement, counterintelligence (CI) investigations, and digital forensic examiners. You will serve as a critical technical resource for investigative teams — recovering encrypted, deleted, and otherwise inaccessible data from seized devices and digital media encountered during active criminal and CI investigations. Core responsibilities include:

• Decrypting encrypted data from mobile devices, computers, and storage media
• Recovering deleted data not recognized by standard carving tools
• Extracting data from flash memory chips with custom or proprietary file systems
• Collaborating with digital forensic examiners to support evidence recovery from locked or damaged devices
• Researching encryption implementations and storage architectures used in consumer and commercial devices to identify recovery pathways
• Producing detailed technical reports documenting methodologies and findings suitable for federal court proceedings or intelligence products

This position requires full-time, onsite attendance Monday through Friday in the Baltimore metropolitan area. 

 

#DC3bonus

Qualifications

Required Qualifications

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD; Additional four years of experience may be considered in lieu of a BS/BA degree. A degree in Mathematics, Computer Science, Cryptography, Information Security, or a related field is highly desired.
• Active TS clearance, SCI eligible.
• Strong programming and scripting proficiency in Python, C++, Java, or similar languages.
• Experience decrypting data from encrypted mobile devices (Android/iOS), full-disk encryption (FDE), and file/container-level encryption schemes.
• Experience recovering deleted or fragmented data beyond the capabilities of standard forensic carving tools
• Experience extracting data from NAND/NOR flash memory chips, including devices with custom or proprietary file systems.
• Familiarity with digital forensic tools and workflows (e.g., Cellebrite, GrayKey, Magnet AXIOM, EnCase, FTK, X-Ways)
• Low-level knowledge of common file systems including FAT, NTFS, EXT2/3/4, APFS, and proprietary embedded file systems.
• Experience supporting law enforcement, CI, or federal investigative operations.

Desired Qualifications

• Experience with hardware-based data recovery techniques including JTAG, chip-off, and ISP (In-System Programming).
• Background in reverse engineering storage protocols, firmware, or encryption implementations on embedded devices.
• Familiarity with legal frameworks governing lawful access and chain-of-custody requirements for recovered data.
• Prior experience supporting DoD, Intelligence Community (IC), or federal law enforcement customers (FBI, DEA, HSI, NCIS, etc.).
• Experience testifying as an expert witness or providing technical declarations in federal proceedings.

Target Salary Range$146,000 - $234,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.