Senior Digital Forensic Examiner

Senior Digital Forensic Examiner

Capital One is looking for a Senior Digital Forensic Examiner (DFE) to join the Cyber Insider Threat & Technical Investigations team. The DFE role will work closely with other Cyber teams and Lines of Business to support internal investigations, incident response, and external investigations. Role duties include conducting forensics collections, data preservation, and analysis of data artifacts  collected from electronic devices such as laptops, workstations, servers, cell phones and multi-cloud architecture. 

Responsibilities:

• Secure handling/collection of digital evidence and maintaining chain of custody

• Lead internal investigations leveraging the use of digital forensics technologies, practices, and philosophies

• Support partner external investigations/incident response as a forensics subject matter expert (SME)

• Managing multiple cases and prioritizing workload

• Develop, follow, and maintain documentation (job aids, playbooks, SOPs, etc) which provide a visual depiction of various operational investigative workflows

• Identify and enhance processes where automation has the potential to improve efficiency

• Create, prepare, and defend detailed technical investigative reports for presenting findings to leadership, corporate investigations, and legal partners

• Maintain and test forensic tooling and processes ensuring integrity of forensics collection, preservation and analysis across an evolving ecosystem.

Basic Qualifications:

• High School Diploma, GED or equivalent certification

• At least 4 years of experience in digital forensics, incident response or cyber investigative analysis 

• At least 4 years of experience leading or conducting cyber technical investigations utilizing at least one of the following digital forensics and incident response tools: EnCase, FTK, Axiom, X-Ways, or Cellebrite

• At least 4 years of experience with computer hardware components, file systems, computer networks, IT security, or incident response

• At least 4 years of experience with forensic preservation, collection, and analysis of operating systems, e-mail systems, and mobile devices

• At least 3 years of technical troubleshooting experience 

• At least 1 year of experience with evidence handling and chain of custody procedures

Preferred Qualifications:

• Bachelor’s Degree in Digital Forensics, Computer Science, Information Systems, or Software Engineering

• 7+ years of experience with Insider Threat or Data Loss Prevention programs, incident management, or investigative programs and the ability to identify anomalous activities and associated risks

• 3+ years experience in investigating cloud computing platforms including AWS, GCP, or Azure

• 3+ years of experience writing queries in Structured Query Language (SQL) or Kibana Query Language (KQL) with a focus on log parsing

• 3+ years of experience developing and communicating recommendations to non-technical business areas

• One or more of the following recognized industry certifications: GIAC GCFA, GIAC GCFE, GIAC GSAF, CFCE, CCE, GCIA, GCIH, Security+, EnCE, or CISSP

At this time, Capital One will not sponsor a new applicant for employment authorization, or offer any immigration related support for this position (i.e. H1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN, or another type of work authorization).

The minimum and maximum full-time annual salaries for this role are listed below, by location. Please note that this salary information is solely for candidates hired to perform work within one of these locations, and refers to the amount Capital One is willing to pay at the time of this posting. Salaries for part-time roles will be prorated based upon the agreed upon number of hours to be regularly worked.

McLean, VA: $193,400 - $220,700 for Manager, Cyber Technical

 

Plano, TX: $175,800 - $200,700 for Manager, Cyber Technical

 

Richmond, VA: $175,800 - $200,700 for Manager, Cyber Technical

 

 

 

 

 

 

 

 

Candidates hired to work in other locations will be subject to the pay range associated with that location, and the actual annualized salary amount offered to any candidate at the time of hire will be reflected so