Principal Digital Forensic Investigator

Apple • Cupertino, CA

16h

About The Position

At Apple, Global Security Investigations (GSI) is a multidisciplinary team of investigators, legal counsel, technical analysts, and forensic experts that investigates risks to Apple’s intellectual property, trade secrets, and confidential information.

The Principal Digital Forensic Investigator serves as a senior technical authority and trusted advisor to executive and legal teams, crafting investigative strategies for critical legal matters. The role leads high-consequence forensic investigations involving insider threats, data theft, media leaks, cybercrime, complex fraud, and other concerns. The successful candidate develops bespoke forensic solutions for a rapidly changing field, builds partnerships across Apple’s businesses, identifies security loopholes, and develops risk remediations.

Requirements

• Principal-level career experience (25+ years) leading complex digital forensic investigations for law enforcement and in the private sector.
• Extensive experience performing digital forensics for high-tech crimes, including trade secret misappropriation, insider threats, data exfiltration, media leaks, cyber incidents, internal fraud, and national-security-grade matters.
• Demonstrated expertise developing bespoke data acquisition and digital forensic solutions.
• Scripting proficiency in Python and Bash.
• Mastery of Apple operating systems (macOS, iOS, iPadOS, and watchOS) and core artifacts such as Plists, SQLite databases, and file system structures, as well as cloud forensics (iCloud, AWS, and GCP).
• Prior qualification as an expert witness in state, federal, or international courts specifically regarding Apple forensics and digital evidence integrity.
• Extensive testimonial experience in civil and/or criminal legal proceedings.
• Prior experience developing and delivering training on macOS forensics to law enforcement and the private sector.
• Deep knowledge of secure handling and storage of physical and electronic evidence in accordance with criminal and civil chain-of-custody procedures and industry best practices.
• Prior employment as a police officer, investigator, or equivalent with a US or international law enforcement agency.
• Extensive experience interviewing witnesses and subjects of investigations.
• Strong background in eDiscovery collections, processing, and data review tools.
• Certification in DFIR, SANS, and/or relevant industry education.
• Ability to deliver accurate, impartial findings with consistent attention to detail.
• Strong verbal and written communication skills.
• Commitment to integrity and confidentiality.

Nice To Haves

• Experience working with Fortune 500 companies.
• Degree in Computer Science, Digital Forensics, Information Systems, or equivalent.

Responsibilities

• Serve as a senior technical authority and trusted advisor to executive and legal teams.
• Craft investigative strategies for critical legal matters.
• Lead high-consequence forensic investigations into insider threats, data theft, media leaks, cybercrime, complex fraud, and other concerns.
• Develop bespoke forensic solutions to address the changing field of digital forensics.
• Build strong partnerships across Apple’s businesses.
• Identify security loopholes and develop risk remediations.
• Develop and deliver training on macOS forensics to law enforcement and the private sector.
• Provide accurate and impartial findings with attention to detail.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed