Cybersecurity Digital Forensics Investigator

Integra•Dallas, TX

About The Position

The Cybersecurity Digital Forensics Investigator conducts cybersecurity investigations involving company-owned computers, mobile devices, electronic records, cloud services, applications, and other digital systems. The role collects, preserves, analyzes, documents, and tracks digital evidence while protecting its integrity and maintaining strict chain-of-custody, confidentiality, and legal-defensibility standards. The investigator works with internal Cybersecurity, Information Technology, Human Resources, Legal, Compliance, Corporate Security, and executive leadership teams, and may coordinate with federal law enforcement, government investigators, outside counsel, and approved forensic specialists. The position investigates suspected data theft, unauthorized access, insider threats, cybersecurity incidents, policy violations, fraud, intellectual property theft, and misuse of company technology. It performs authorized forensic acquisitions and analysis, develops investigative timelines from approved sources, supports incident response, manages evidence and case records, and prepares detailed reports. The investigator may respond to authorized legal and government requests, provide technical briefings, and offer factual testimony or other technical support when authorized. Conclusions must be impartial and grounded in documented evidence. Integra describes itself as a vertically integrated data-center infrastructure company that manages work from site selection and design through manufacturing, procurement, commissioning, and warranty. It emphasizes collaboration, accountability, continuous improvement, and delivering mission-critical infrastructure.

Requirements

Bachelor’s degree in Cybersecurity, Digital Forensics, Computer Science, Information Technology, Criminal Justice, or a related field.
At least 7 years of experience in cybersecurity, digital forensics, incident response, law enforcement investigations, corporate investigations, or a related discipline.
At least 3 years of hands-on experience conducting digital forensic examinations or cybersecurity investigations.
Demonstrated experience investigating mobile devices, computers, email systems, cloud environments, and electronic records.
Experience maintaining chain-of-custody documentation and producing legally defensible investigation reports.
Working knowledge of forensic imaging, evidence validation, file systems, operating-system artifacts, network logs, and security-event data.
Experience coordinating sensitive investigations with Legal, Human Resources, Compliance, Corporate Security, or government agencies.
Ability to handle highly confidential, privileged, personal, and legally sensitive information.
Strong written, verbal, analytical, interviewing, and presentation skills.
Ability to obtain and maintain any security clearance, background investigation, or federal eligibility requirement applicable to the position.
Strong technical expertise, professional judgment, attention to detail, and ability to conduct confidential, legally defensible, impartial investigations.

Nice To Haves

One or more of the following certifications: Certified Information Systems Security Professional (CISSP); GIAC Certified Forensic Examiner (GCFE); GIAC Certified Forensic Analyst (GCFA); GIAC Advanced Smartphone Forensics (GASF); Certified Computer Examiner (CCE); EnCase Certified Examiner (EnCE); Certified Cyber Forensics Professional (CCFP) or equivalent; Cellebrite Certified Mobile Examiner (CCME).

Responsibilities

Conduct cybersecurity and digital forensic investigations involving mobile devices, computers, removable media, servers, email systems, cloud platforms, applications, and other electronic records.
Investigate suspected data theft, unauthorized access, insider threats, cybersecurity incidents, policy violations, fraud, intellectual property theft, and misuse of company technology.
Acquire and preserve forensic images and other digital evidence using approved tools and legally defensible procedures.
Analyze authorized mobile-device data and examine operating-system, cloud, email, network, and application artifacts relevant to investigations.
Recover, correlate, and analyze deleted, hidden, encrypted, or otherwise protected information when legally authorized and technically feasible.
Develop investigation timelines by correlating information from devices, security systems, access records, network logs, email, cloud services, and other authorized sources.
Identify indicators of compromise, suspicious behavior, unauthorized data transfers, and potential violations of company policies or applicable laws.
Support incident response through evidence collection, containment analysis, root-cause investigation, and post-incident reporting.
Collect, label, preserve, store, transfer, and track digital evidence according to chain-of-custody procedures.
Maintain accurate evidence logs, forensic notes, investigation records, device inventories, custody documentation, and case files.
Protect evidence integrity, authenticity, confidentiality, and availability; validate forensic images and collected data using hashing and other industry-standard techniques.
Store evidence securely and ensure access is limited to authorized personnel.
Maintain case files according to company retention requirements, legal-hold instructions, contractual obligations, and applicable regulations.
Document investigative actions to support internal reviews, legal proceedings, regulatory inquiries, and law-enforcement requests.
Act as a technical liaison with authorized federal law enforcement and government investigation teams, coordinating secure exchanges of approved evidence and findings.
Coordinate responses to authorized subpoenas, warrants, preservation requests, legal holds, and government information requests with Legal and executive leadership.
Support interviews, technical briefings, case reviews, and evidence presentations involving internal stakeholders, outside counsel, or government investigators.
Explain technical findings to technical and nontechnical audiences, and provide factual testimony, declarations, affidavits, or expert technical support when authorized and required.
Maintain professional independence and base investigative conclusions on documented evidence.
Maintain a centralized system for tracking investigation cases, devices, evidence, activities, findings, deadlines, and case status.
Create detailed forensic reports describing scope, methodology, tools, evidence examined, findings, limitations, and conclusions.