Digital Forensic Scientist

~RECRUITMENT RANGE: $55,823 - $74,520/NC16~

The North Carolina Department of the Secretary of State is the heartbeat of the business community promoting economic growth and protecting the public from financial harm. The Department works with business, banking and legal communities to strengthen our state's economy with a state-of-the-art system of reliable business and governmental records. We also safeguard individuals and businesses against fraud. Learn more by visiting our website www.sosnc.gov.

DESCRIPTION OF WORK:

Join one of the top 100 ISO/ANAB-accredited digital forensic laboratories in the United States. The North Carolina Department of the Secretary of State seeks an experienced professional to support our nationally recognized Digital Forensic Laboratory.

The Department fulfills statutory mandates that promote economic growth, enable capital formation, and protect the public from financial and, in some cases, physical harm. Our law enforcement agents, attorneys, and task force partners combat business, notary, and financial fraud; identity theft; intellectual property theft (including counterfeit goods); and related white-collar crimes-threats that undermine the economic well-being of individuals and businesses.

Operating under the authority of the Secretary of State, the Digital Forensic Laboratory supports these investigations by processing digital evidence and producing professional reports.

This position plays a key role in assisting investigators by delivering accurate, professional evidentiary analysis. The Digital Forensic Scientist must have hands-on experience in forensic acquisition, imaging, analysis, and reporting.

PRIMARY PURPOSE OF THE POSITION

The Digital Forensic Scientist will:

• Assist with search warrants and the seizure/preservation of physical and digital evidence.
• Conduct forensic analyses and produce reports for judicial proceedings.
• Perform in-lab analyses, provide technical field support, and testify as an expert witness.
• Recover or download digital data, including from websites used in financial fraud.
• Support the Litigation Support Section by coordinating data access for trial preparation.

Management Preferences:

• Expertise in digital forensics tools, hardware, and software for acquiring, analyzing, and preserving evidence.

• Strong knowledge of lab best practices, ISO/IEC 17025 standards, and secure evidence handling.

• Skilled in forensic imaging, data recovery (including deleted/password-protected files), and device/media examination.

• Experience with system firmware, boot records, configurations, and command files.

• Proficient in analyzing video, websites, text, graphics, and multimedia.

• Knowledge of chain-of-custody procedures and evidence labeling.

• Strong communication skills for technical reporting, court testimony, and training.

• Ability to work with investigators, attorneys, and court personnel on case preparation.

• Experience supporting audits and compliance reviews.

• CERTIFICATION AND CREDENTIAL PREFERENCES

• Vendor-neutral certification (CFCE preferred).

• One or more vendor certifications: EnCE, MCFE, CFME, CCPA, CCME (with/without Inseyets).

• Additional desirable credentials: CAWFE, CMDE, CCE, ISFCE membership.

• ANAB training on ISO/IEC 17025:2017 preferred.

• Note: If not already certified, the selected candidate must obtain certifications consistent with agency preferences and accreditation standards within 18 months of eligibility.

Experience with:

• Leading forensic tools (EnCase, Cellebrite, Magnet, FTK, BlackLight, GrayKey, etc.).
• Mac/Windows file systems, iOS, Android.
• Encryption technologies (BitLocker, SecureBoot, TPM).
• Forensic acquisition from varied devices and platforms (cloud/on-prem servers, email, social media).
• ISO/IEC 17025:2017 lab accreditation processes.
• State and federal rules of evidence compliance.
• Website/SharePoint administration.
• Hashing methods, large dataset transfers, and Bates numbering.

Bachelor's degree with a major in computer science, digital forensics, networking, information technology, cyber technology, criminal justice; or forensic science or multi-media studies with coursework in computer science or information technology; or biology, chemistry, physics, biochemistry and other science degrees (if degree includes significant coursework in computer science or information technology); or closely related curriculum from an appropriately accredited institution including coursework in science; and two years of experience performing bench level analysis in digital evidence; or an equivalent combination of education and experience.

Necessary Special Requirement (Digital): Must obtain individual certification consistent with international and ISO standards within eighteen months of the date the analyst becomes eligible to seek certification according to the standards of the certifying entity. Such vendor-neutral certifications may include: Certified Computer Forensic Examiner (CFCE) - International Association of Computer Investigative Specialists, Certified Computer Examiner (CCE) - International Society of Forensic Computer Examiners Digital Forensics Certified Practitioner (DFCP) - Digital Forensics Certification Board (requires a minimum 5 years of verified experience prior to sitting for the exam), Global Information Assurance Certification Forensic Examiner (GCFE) - SANS Institute, Certified Video Technician (CFVT) - Law Enforcement & Emergency Service Video Association (requires a minimum of 3 years of verified experience prior to sitting for the exam), Certified Forensic Video Examiner (CFVE) - International Association for Identification (requires a minimum of 3-5 years of verified experience depending on applicant's education level)