Forensics Examiner (Several Levels)

Parsons Corporation•Minneapolis, MN

19d•$88,400 - $154,700

About The Position

Parsons is seeking a Digital Forensic Examiner at one of several levels to conduct forensic examinations of digital and multimedia evidence in support of investigative and legal proceedings. The role includes analyzing artifacts and user activity, maintaining evidence integrity, and preparing technically accurate forensic reports. Examinations may cover forensic images, computers, mobile devices, virtual assets, malware, system logs, network traffic, memory snapshots, and other submitted data. The examiner uses commercial and open-source forensic tools, performs initial triage and detailed evidence analysis, maintains chain-of-custody records, validates tools and verifies outputs, and participates in technical peer reviews. Depending on assignment and qualifications, the role may also support expert-witness preparation and testimony, quality assurance and accreditation activities, metrics analysis, training, mentorship, and process improvement. The position is part of Parsons’ Federal Solutions team and requires an active Secret security clearance.

Requirements

Active Secret security clearance.
Bachelor’s degree in Digital Forensics, Computer Science, Cybersecurity, Information Technology, Criminal Justice, or a related field; four years of hands-on digital-forensics experience may substitute for the degree.
Minimum hands-on digital-forensics experience appropriate to the assigned level: Forensic Examiner 1 requires two years; Forensic Examiner 2 requires five years; Forensic Examiner 3 requires eight years; Forensic Examiner 4 requires 12 years.
Ability to conduct forensic examinations, interpret digital artifacts, analyze user activity, and document findings.
Experience maintaining chain-of-custody records and handling evidence in accordance with laboratory procedures and security requirements.
Ability to prepare accurate, complete, and professionally formatted forensic reports.
Ability to use forensic tools and perform forensic image, extraction, hashing, timestamp, artifact, and anti-forensic analysis.
Strong attention to detail, analytical ability, technical judgment, and written communication skills.
Ability to work independently and collaborate effectively with investigators, attorneys, technical reviewers, government personnel, and multidisciplinary teams.

Nice To Haves

Top Secret clearance with SCI eligibility is preferred.
At least one active certification, or an equivalent certification approved by the COR, such as DC3 Cyber Training Academy Digital Forensic Examiner; GIAC Certified Forensic Analyst; GIAC Certified Forensic Examiner; EnCase Certified Examiner; Digital Media Collector; Digital Forensic Examiner; Cyber Crime Investigator; Computer Hacking Forensic Investigator; IACIS Certified Forensic Computer Examiner; IACIS Certified Mobile Device Examiner; IACIS Certified Advanced Windows Forensics Examiner; Cellebrite Certified Mobile Examiner; Oxygen Forensic Certified Examiner; X-Ways Professional in Evidence Recovery Techniques; or Magnet Certified Forensic Examiner.
Formal training dedicated to expert-witness testimony, rules of evidence, and courtroom procedure, such as DC3’s 40-hour Forensic Trial Training course, completed within the last three years when required for assigned duties.
Experience with EnCase, FTK, X-Ways, Cellebrite, Oxygen Forensics, Magnet Forensics, or comparable forensic platforms.
Experience validating forensic tools, verifying tool outputs, developing scripts, and using version-control practices.
Experience supporting peer review, expert-witness preparation, affidavits, warrants, depositions, moot court sessions, or courtroom testimony.
Experience supporting quality-assurance programs, SOP implementation, accreditation activities, competency testing, audits, and laboratory metrics.
Experience with malware analysis, memory forensics, network forensics, mobile-device examinations, virtual assets, system logs, and anti-forensic techniques.

Responsibilities

Conduct forensic examinations of digital and multimedia evidence, including forensic images, computers, mobile devices, virtual assets, malware, system logs, network traffic, memory snapshots, and other submitted data.
Use commercial and open-source forensic tools, including EnCase, FTK, X-Ways, and approved government tools, to analyze digital devices.
Perform evidence identification, forensic image and extraction review, hashing, timestamp analysis, artifact interpretation, anti-forensic detection, and user-activity reconstruction.
Conduct initial forensic triage to identify key artifacts, determine examination scope, and support case assignment and prioritization.
Maintain accurate chain-of-custody documentation and handle, store, transfer, and dispose of evidence in accordance with laboratory procedures and security requirements.
Prepare complete, technically accurate, and professionally formatted Forensic Analysis Reports.
Validate forensic tools, document validation results, verify tool outputs, and develop or maintain approved scripts using version-control practices, as assigned.
Participate in technical peer reviews of forensic reports and incorporate review comments.
Support expert-witness preparation, affidavits, warrants, mock depositions, moot court sessions, and testimony when designated and qualified.
Support quality-assurance activities, including SOP implementation, audit readiness, competency testing, and accreditation-related documentation.
Support collection and analysis of metrics involving case volume, backlog, throughput, cycle time, timeliness, workload, rework, error rates, and quality indicators.
Provide technical input to training, mentorship, process-improvement, and lessons-learned activities.