Digital Forensics Lead (CBP)

Agile Defense • Ashburn, VA

1d • Hybrid

About The Position

The U.S. Customs and Border Protection (CBP) runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. When an incident occurs on a system supporting this mission, whether it's a confirmed intrusion, an insider case, or an incident still being scoped, the need to understand what happened and have proof is critical. This role leads digital forensics for this program, focusing on preserving and analyzing evidence from compromised or suspect systems, reconstructing events, and producing findings that can be acted upon by incident response, threat hunt, and insider threat monitoring teams. The role emphasizes the importance of chain of custody and defensible processes, as a forensic finding that cannot withstand scrutiny is worse than no finding at all. Success in this role involves preserving evidence meticulously, reconstructing events accurately, delivering actionable findings to relevant teams and external parties, and building a forensics capability that improves in speed and reliability over time.

Requirements

• Led digital forensic investigations that produced findings used for disciplinary, legal, or law enforcement action.
• Ability to describe how chain of custody is maintained and its importance for defensible findings.
• Experience with forensics in a federal or highly regulated environment.
• Experience delivering forensic findings to non-technical audiences (legal, HR, leadership).
• U.S. Citizenship required.
• Active CBP Background Investigation (CBP BI) and EOD strongly preferred.

Nice To Haves

• Active CBP BI, a fitness determination at another DHS component, or an active DoD clearance.
• Certifications such as GCFE, GCFA, or EnCE.

Responsibilities

• Preserve evidence following chain of custody for all cases, ensuring nothing needed for analysis is missed.
• Reconstruct events accurately, answering the specific questions asked and reconciling activity across systems.
• Deliver findings to incident response, threat hunt, and insider threat monitoring teams, framed for their needs.
• Document findings to the standard required for disciplinary, legal, or law enforcement action.
• Explain technical findings to non-technical decision-makers.
• Develop faster and more consistent processes for recurring case types.
• Review tooling and technique choices against real-world case performance.
• Incorporate lessons learned from cases to improve program practice.

Benefits

• Health Insurance
• Life Insurance
• Paid Time Off
• Holiday Pay
• Short-term and long-term Disability
• Retirement
• Learning and Development opportunities
• Other optional benefit elections
• $10,000 signing bonus for candidates with an active CBP BI (Payable after 90 days; standard terms apply).

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed