Digital Forensic Lead (CBP)

Agile Defense•Ashburn, VA

3d•Hybrid

About The Position

The U.S. Customs and Border Protection (CBP) runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. This role is responsible for leading digital forensics for this program. The primary function is to preserve and analyze evidence from compromised or suspect systems, reconstruct events, and produce findings that can be acted upon by incident response, threat hunt, and insider threat monitoring leads. These findings may also support disciplinary, legal, or law enforcement actions. The role emphasizes the critical importance of chain of custody and defensible processes to ensure the integrity and validity of forensic findings.

Requirements

Active CBP Background Investigation (CBP BI) and EOD strongly preferred.
U.S. Citizenship required.
Experience leading digital forensic investigations that produced findings used for disciplinary, legal, or law enforcement action.
Ability to describe how chain of custody is maintained and its importance for findings.
Experience with forensics in a federal or highly regulated environment.
Experience delivering a forensic finding to a non-technical audience, legal, HR, or leadership.
Hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance.

Nice To Haves

Certifications such as GCFE, GCFA, or EnCE.

Responsibilities

Preserve evidence following chain of custody for all cases.
Ensure forensic processes can withstand scrutiny.
Preserve necessary evidence in a timely manner for analysis.
Reconstruct events accurately, answering the specific questions asked.
Acknowledge ambiguity in evidence rather than forcing conclusions.
Build timelines that reconcile activity across multiple systems.
Deliver findings to other teams (incident response, threat hunt, insider threat monitoring) framed for their needs.
Document findings supporting disciplinary, legal, or law enforcement action to the required standards.
Explain technical findings to non-technical decision-makers.
Develop faster and more consistent processes for recurring case types.
Review tooling and technique choices based on real-world case performance.
Incorporate lessons learned from cases into the program's practices.