Digital Evidence Examiner | Incident Reconstruction Specialist

About the role

A full-time, mid-level to senior Digital Evidence Examiner / Incident Reconstruction Specialist is sought to conduct digital forensic examinations, analyse electronic evidence and reconstruct incidents involving computer systems, digital devices, networks and electronic data. The role combines digital forensics, evidence preservation, incident analysis and technical reconstruction, working with cybersecurity teams, investigators, legal professionals and compliance departments.

Key responsibilities

• Identify, collect, preserve and examine digital evidence following established forensic procedures, with proper documentation and chain of custody.
• Perform forensic imaging and data acquisition, and analyse file systems, OS artifacts, logs, metadata and deleted or hidden data.
• Reconstruct timelines of digital activity and investigate incidents such as unauthorized access, malware, data breaches and insider threats.
• Analyse network logs, email records, mobile device artifacts and other digital sources, correlating them to build incident timelines.
• Validate findings, document procedures and prepare comprehensive forensic reports, timelines, diagrams and evidence summaries.
• Work with incident response, legal and compliance teams, present findings to stakeholders and support evidence packages for investigations and proceedings.

Required profile

• Bachelor's degree in Digital Forensics, Cybersecurity, Computer Science, IT, Computer Engineering or a related field.
• Experience in digital forensics, incident investigation or electronic evidence handling; experience supporting legal, corporate or regulatory investigations is an advantage.
• Strong analytical, critical-thinking and problem-solving skills, with excellent technical writing and attention to detail.
• Ability to communicate technical findings clearly to technical and non-technical audiences and to handle confidential information securely.

Required skills

• Knowledge of Windows, Linux and macOS environments and their forensic artifacts.
• Forensic imaging, hashing and data integrity verification.
• Experience with EnCase, FTK, Autopsy, X-Ways Forensics or Magnet AXIOM; mobile forensics knowledge is advantageous.
• Familiarity with network traffic analysis, system logs and incident response frameworks; ISO/IEC 27037 or NIST guidance is beneficial.

What we offer

• Competitive salary and comprehensive employee benefits.
• Exposure to complex cases and advanced forensic tools, with professional development opportunities.
• Collaboration with investigators, cybersecurity specialists and legal professionals.