Manager, Digital Forensics & Cyber Investigations

Hilco Global•Chicago, IL

23h•Onsite

About The Position

Hilco Global is expanding its Global Investigations & Dispute Resolution practice and is seeking a Manager to lead day-to-day execution of digital forensics and cyber-enabled investigations. This role focuses on digital evidence analysis, cyber-enabled misconduct, user-activity reconstruction, data misuse, and insider-risk issues. The Manager will help clients and counsel identify, preserve, collect, analyze, and explain digital evidence in various sensitive matters. This position is ideal for professionals who want to help build a growing digital evidence and cyber investigations capability within a broader investigations and disputes platform, leveraging Hilco's strong market presence and cross-disciplinary opportunities.

Requirements

Bachelor's degree in computer science, information systems, cybersecurity, digital forensics, accounting, finance, business, or a related discipline required.
Approximately 4-7 years of relevant experience in digital forensics, cyber investigations, forensic technology, incident investigation, insider-risk investigations, or related professional services.
Hands-on experience with forensic acquisition, evidence preservation, chain of custody, artifact analysis, timeline development, and defensible technical workpapers.
Familiarity with Windows, macOS, mobile, cloud, email, collaboration, and enterprise logging environments.
Strong report-writing, presentation, and client communication skills, including the ability to explain technical issues to counsel and business stakeholders.
Experience supervising junior professionals and managing workstreams, deadlines, and quality-control processes.

Nice To Haves

Candidates with master's degrees or other advanced technical degrees are strongly encouraged and will be prioritized.
Experience with tools such as EnCase, FTK, Cellebrite, Magnet AXIOM, X-Ways, Nuix, Relativity, Microsoft Purview, Google Vault, CrowdStrike, Splunk, or similar platforms is preferred.
Professional credentials such as EnCE, GCFE, GCFA, GASF, CCE, CFCE, CISA, CISSP, RCA, CEDS, or similar certifications are advantageous.
Willingness to travel based on client and business needs.

Responsibilities

Lead day-to-day execution of digital forensics and cyber investigations workstreams, including evidence preservation, forensic collection, artifact analysis, timeline reconstruction, and reporting.
Conduct or oversee forensic imaging, targeted collections, cloud and collaboration-platform collections, mobile-device collections, mailbox collections, log preservation, and other evidence acquisition activities.
Analyze artifacts from laptops, desktops, servers, mobile devices, email, cloud repositories, collaboration platforms, file shares, logs, and other sources of digital evidence.
Support investigations involving unauthorized access, data misuse or exfiltration, file deletion or movement, USB activity, off-channel communications, insider risk, business email compromise, and technology-enabled misconduct.
Develop clear timelines and user-activity reconstructions that connect system artifacts, communications, documents, access logs, metadata, and business records.
Maintain chain-of-custody documentation, defensible procedures, workpapers, and quality-control protocols.
Coordinate with forensic accounting, investigative, e-discovery, analytics, legal, IT, HR, compliance, and security teams to connect technical findings to broader factual and financial issues.
Prepare and review client-facing reports, memoranda, presentations, timelines, and exhibits explaining digital evidence in clear, non-technical language.
Supervise, coach, and develop Analysts, Associates, and other team members through active review and feedback.
Support proposals, pitch materials, recruiting, training, tool evaluation, and other internal practice-building initiatives.