Digital Forensics & eDiscovery Manager

KLA•Milpitas, CA

1d•$174,300 - $296,300•Onsite

About The Position

As a member of the Legal and Compliance Organization (“LCO”), you will lead KLA’s digital forensics, investigations support, ESI preservation, eDiscovery, information governance, and forensic advisory functions. You will serve as the primary escalation point and subject-matter lead for digital forensic investigations, legal holds, eDiscovery collections and review, insider risk support, mobile and remote collections, cloud and collaboration-platform evidence, AI-related evidence, and cross-functional matters involving Legal, Compliance, Human Resources, Cybersecurity, IT, Intellectual Property, and business stakeholders. The role requires a hands-on leader who can mentor a global team, apply forensic judgment to new technologies, and translate complex data into accurate, defensible, timely, and business-relevant findings.

Requirements

Bachelor’s degree preferred in Digital Forensics, Computer Science, Computer Engineering, or a related field.
Minimum of 5 to 7 years of experience in digital forensics, investigations, eDiscovery, incident response, information governance, or supporting investigators as an analyst, examiner, program lead, or equivalent role.
Demonstrated ability to lead a high-performing team, manage contractors and vendors, and collaborate across departments, regions, time zones, and senior stakeholder groups.
Ability to manage multiple investigations, legal holds, data requests, eDiscovery matters, incident response support activities, and special projects concurrently.
Experience operating in a legal or compliance environment where privilege, confidentiality, proportionality, defensibility, and coordination with counsel are critical.
Excellent communication, stakeholder coordination, project management, and team leadership skills.
Ability to lift, move, open, disassemble, and assemble up to 50 pounds of computers, laptops, servers, and other computing devices.

Nice To Haves

Experience drafting forensic reports, declarations, certifications, affidavits, witness statements, or similar materials and explaining findings in litigation, regulatory, employment, law enforcement, or similar proceedings.
Experience managing external forensic, eDiscovery, OSINT, incident response, and international investigation vendors.
Relevant certifications or training in digital forensics, incident response, eDiscovery, cybersecurity, OSINT, cloud forensics, mobile forensics, or AI governance are desirable.
Previous multinational company experience and ability to support multiple global time zones and international travel are highly desirable.

Responsibilities

Lead, mentor, and develop a global digital forensics and eDiscovery team, including internal analysts, contractors, external vendors, and regional support partners.
Oversee defensible forensic analysis, evidence preservation, data collection, review support, reporting, and evidence interpretation for investigations, legal matters, business functions, and global evidence management activities.
Analyze evidence from endpoint DLP, Microsoft 365 Purview, Teams, Outlook, OneDrive, SharePoint, SIEM/security logs, Intune/MDM, mobile devices, network/cloud artifacts, OSINT sources, and AI prompts, outputs, and usage logs where available.
Manage forensic imaging, remote endpoint collections, targeted mobile collections, evidence intake, release, disposition, and chain-of-custody processes in accordance with applicable law, policy, and legal hold obligations.
Improve eDiscovery and ESI preservation processes, including legal holds, custodian identification, data collection, review set preparation, reconciliation, release workflows, and defensible retention or disposition decisions.
Develop defensible approaches for AI-related evidence, including prompts, inputs, outputs, usage logs, model-assisted summaries, and AI-generated or AI-modified content, with appropriate human validation and privilege, privacy, security, and records-management controls.
Partner with Cybersecurity and IT on incident response, insider risk, monitoring, logging, forensic readiness, threat-related investigations, and post-incident evidence preservation.
Support LCO special projects, including information governance, data mapping, records and hard-drive disposition, communication monitoring governance, fraud and impersonation takedowns, dawn raid readiness, policy initiatives, training, dashboards, and workflow automation.