Forensic Analyst II

Overview

JOB TITLE: Forensic Analyst II

AGENCY SUPPORTED: U.S. Department of Justice (DOJ) – MEGA 6 Automated Litigation Support

POSITION TYPE: Full-Time, Contingent Upon Award

LOCATION: Remote

CLEARANCE: Public Trust – Candidates do not need to be cleared at the time of application but must be able to obtain and maintain a Public Trust clearance prior to starting.

BENEFITS: Health, Dental and Vision, 401(k), Tuition Reimbursement, Flexible Spending Account (FSA), 11 Paid Federal Holidays, 3 weeks9 Paid Time Off

We are seeking an experienced Forensic Analyst II to support ITC Federal9s work for the U.S. Department of Justice (DOJ) under the anticipated MEGA 6 automated litigation support (ALS) program. This is a fully remote position supporting DOJ9s complex litigation mission.

Important: This opening is being established in connection with the MEGA 6 contract vehicle award itself. ITC Federal must still be awarded individual task orders under the vehicle before employees can be onboarded. Accordingly, this position is full-time and contingent upon both contract award and the award of the applicable task order.

POSITION OVERVIEW:

Functions in a lead capacity assuming responsibilities as a technical specialist.

PROGRAM CONTEXT:

This position supports the U.S. Department of Justice (DOJ) under the anticipated MEGA 6 procurement. MEGA 6 is expected to continue DOJ9s multiple-award contract vehicle for automated litigation support (ALS) services, following the structure of the MEGA 5 contract. These contracts are designed to provide DOJ offices, boards, divisions, and other federal agencies with information technology, professional services, and litigation support tools to manage complex legal proceedings efficiently.

Responsibilities

RESPONSIBILITIES:

• Duties include: case assignment, case management, scene management, and other similar duties of a first line supervisor.
• Operates at a senior-level, applying industry accepted digital forensic principles in acquiring, collecting, preserving, and processing structured and unstructured data per established industry best practices and laboratory procedures and protocols.
• Responsible for managing digital forensics examinations through the entire lifecycle (case planning, intake, acquisition, examination, analysis, extraction, presentation, disposition, and expert witness testimony).
• Provides identification and seizure support, forensic data acquisition/imaging; forensically-sound and non-forensic collection/capture of electronically stored information (ESI) from innumerable file structures and sources (i.e., Windows, MAC, Linux, and Unix-based desktop/laptop computer systems, servers to include Exchange, Database, Files Shares, and cloud-based email and storage; mobile devices and tablets (all operating systems), drones, and related digital storage media.
• Uses vast knowledge and experience of a wide variety of advanced computer and mobile technologies and forensic theories to conduct full forensic examinations/analyses to include processing of allocated and unallocated space and file slack, data carving, and conducting timeline, Internet history, and registry analyses with the goal of developing forensically sound evidence.
• Responsible for performing large-scale digital forensic examinations to include collection in a live client-server environment utilizing validated remote forensic software.
• Recovers data and correlates information, prepares clear and comprehensive notes and reports of findings, and provides oral and written communications to legal staff concerning results of examinations to include legal declarations as well as expert witness testimony at trial for investigations and litigations.
• Utilizes industry accepted forensic and non-forensic tools such as EnCase, FTK, Harvester, Cellebrite UFED, and NUIX.
• Researches and maintains proficiency in tools, techniques, and trends.
• As a digital forensics expert, serves as a source of technical counsel and advice for forensic collection/processing activities.
• Acts as a source of reference for junior analysts and technicians and possesses the ability to lead forensic investigations in the field.
• Reviews and approves reports, notes, and case files of junior analysts and technicians.
• Collaborates with other forensic analysts and technicians, law enforcement officers, and legal experts to identify methods and procedures for recovery, preservation, and presentation of computer evidence.
• Provides technical guidance and assistance to legal staff while ensuring that proper precautions are taken in the preservation and prevention of spoliation of electronic evidence.
• Complies with standards, policies, and procedures established for the forensics laboratory including accreditation requirements, supplements, criteria, and interpretations as it applies to digital evidence.
• May supervise a team of digital forensic analysts

Qualifications

REQUIRED:

• Ability to obtain and maintain a U.S. Government Public Trust clearance prior to start (candidates are not required to be cleared at the time of application).
• Authorized to work in the United States.
• Ability to work effectively in a fully remote environment.
• Undergraduate degree in Digital Forensic Science, Computer Science/Engineering, Computer Information Systems, Mathematics, Criminal Justice, or a related field; preferred a Master9s degree in Digital Forensic Science, Computer Science/Engineering, Computer Information Systems, Mathematics, Criminal Justice, or a related field and 7 to 10 years9 current digital forensics collection and processing experience is required.
• The Contracting Officer may consider 10 years of current industry related Digital Forensics experience as a substitute for degree.
• Must possess and maintain at least 2 of the following certifications: CompTIA4 A+; CompTIA4 Network+, CompTIA4 Server+ Certification; or IACIS4 Certified Forensic Computer Examiner (CFCE), ISFCE Certified Computer Examiner (CCE), or similar non-vendor specific certification; or EnCase4 Certified Examiner (EnCE), AccessData Certified Examiner (ACE), Cellebrite Certified Mobile Examiner (CCME) Certification (CCME), or similar vendor specific certifications.
• Must possess extensive enterprise level experience conducting digital forensics collections and processing across a variety of operating systems and hardware and software architectures (e.g., computers, mobile devices, file share, email, and database servers, and cloud-based storage).
• Must have demonstrated senior-level experience in the use of industry standard forensic tools such as EnCase4 Forensic and Enterprise Editions, Forensic Toolkit4, NUIX Investigator, Cellebrite UFED, etc. and be able to articulate the processes being conducted by these forensic tools.
• Must have demonstrated working knowledge of LAN/WAN/MAN network environments.
• Must have demonstrated experience in dead box, live and hybrid data acquisition methodologies.
• Must have demonstrated experience in the forensic, forensically sound, and non-forensic collection and processing of a wide variety of enterprise e-mail and database systems such as Exchange, Lotus, SQL, Oracle, etc., archiving systems, and backup systems.
• Must have demonstrated experience in the manual reconstruction of a RAID array.
• Must have demonstrated working experience in the processing of large data volumes.
• Must have demonstrated working knowledge of and ability to apply the Federal Rules of Evidence (FRE) as they apply to electronic evidence as well as demonstrated experience in applying these rules to the framework of an investigation or litigation.
• Must have demonstrated experience testifying and taking testimony in a civil, criminal, regulatory or administrative proceeding.
• Must have demonstrated strong project management skills with the ability to multitask and manage several projects at one time.
• Moderate travel is required.

WORK ENVIRONMENT AND PHYSICAL DEMANDS:

• This is a fully remote position; work is performed from a home office.
• Must be located in or near the Washington, DC area and available for short-notice on-site meetings.
• Work is primarily sedentary, performed while using a computer for extended periods of time.