Digital Forensic Extraction

Spry Methods is seeking a Forensic Acquisition and Extraction Lead to direct all forensic imaging and data extraction activities in the Cyber Forensics Laboratory (CFL). This position manages the Imaging and Extraction section and gives its staff technical oversight. It is responsible for evidence acquisition from hard drives, mobile devices, and IoT devices, and for running laboratory workflows and maintaining chain-of-custody documentation.

What Your Day-To-Day Looks Like (Position Responsibilities):

• Lead forensic imaging, evidence acquisition, and data extraction operations. 

• Provide direct management and technical oversight of Imaging and Extraction section personnel. 

• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction. 

• Maintain accurate chain-of-custody documentation and evidence accountability. 

• Ensure imaging and extraction tasks are completed in accordance with the PWS. 

• Oversee testing and validation of forensic imaging tools and write-blockers. 

• Monitor the quality and efficiency of team performance. 

• Serve as the primary Government technical point of contact for imaging and extraction activities. 

• Proactively identify and communicate technical, programmatic, and resource limitations. 

What You Need to Succeed (Minimum Requirements):

• TS/SCI clearance eligible. 

• Active DFE, GCFE, EnCase Certified Examiner (EnCE), or equivalent certification approved by the COR. 

• At least seven years of hands-on digital forensics experience, including at least five years focused on evidence acquisition, forensic imaging, and data extraction from media such as hard drives, mobile devices, and IoT devices. 

• At least three years of leadership or supervisory experience within the last five years managing a digital forensics team, laboratory workflows, and chain-of-custody documentation. 

• Demonstrated experience within the last three years testing and validating forensic imaging tools and write-blockers.