Digital Forensic Extraction Lead

Spry Methods, Inc.; Linthicum (MD); On-site; USD 140,000 - 180,000; Full time

Job summary

Spry Methods, Inc. is seeking a Forensic Acquisition and Extraction Lead to direct all imaging and data extraction activities in the Cyber Forensics Laboratory (CFL).

The role oversees the Imaging and Extraction section and staff, ensuring evidence acquisition from hard drives, mobile devices, and IoT devices with compliant chain-of-custody documentation. You will guide lab workflows, validate imaging tools and write-blockers, and act as the Government technical point of contact for

Qualifications

• Seven+ years of hands-on digital forensics experience with emphasis on evidence acquisition, imaging, and data extraction from drives, mobiles, and IoT devices.
• Three+ years in leadership or supervisory roles managing a digital forensics team, workflows, and chain-of-custody practices.
• Experience testing and validating forensic imaging tools and write-blockers within the last three years.

Responsibilities

• Lead forensic imaging, evidence acquisition, and data extraction operations.
• Provide direct management and technical oversight of Imaging and Extraction section personnel.
• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction.
• Maintain accurate chain-of-custody documentation and evidence accountability.
• Ensure imaging and extraction tasks are completed in accordance with the PWS.
• Oversee testing and validation of forensic imaging tools and write-blockers.
• Monitor the quality and efficiency of team performance.
• Serve as the primary Government technical point of contact for imaging and extraction activities.
• Proactively identify and communicate technical, programmatic, and resource limitations.

Skills

Leadership

Forensic imaging

Evidence acquisition

Data extraction

Communication

Tools

Write-blockers

Forensic imaging tools

Job description

Spry Methods is seeking a Forensic Acquisition and Extraction Lead to direct all forensic imaging and data extraction activities in the Cyber Forensics Laboratory (CFL). This position manages the Imaging and Extraction section and gives its staff technical oversight. It is responsible for evidence acquisition from hard drives, mobile devices, and IoT devices, and for running laboratory workflows and maintaining chain-of-custody documentation.

What Your Day-To-Day Looks Like (Position Responsibilities):

• Lead forensic imaging, evidence acquisition, and data extraction operations.
• Provide direct management and technical oversight of Imaging and Extraction section personnel.
• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction.
• Maintain accurate chain-of-custody documentation and evidence accountability.
• Ensure imaging and extraction tasks are completed in accordance with the PWS.
• Oversee testing and validation of forensic imaging tools and write-blockers.
• Monitor the quality and efficiency of team performance.
• Serve as the primary Government technical point of contact for imaging and extraction activities.
• Proactively identify and communicate technical, programmatic, and resource limitations.

What You Need to Succeed (Minimum Requirements):

• TS/SCI clearance eligible.
• Active DFE, GCFE, EnCase Certified Examiner (EnCE), or equivalent certification approved by the COR.
• At least seven years of hands‑on digital forensics experience, including at least five years focused on evidence acquisition, forensic imaging, and data extraction from media such as hard drives, mobile devices, and IoT devices.
• At least three years of leadership or supervisory experience within the last five years managing a digital forensics team, laboratory workflows, and chain-of-custody documentation.
• Demonstrated experience within the last three years testing and validating forensic imaging tools and write‑blockers.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

Final compensation will be based on experience, qualifications, certifications, clearance level, and contract requirements. This position is contingent upon contract award.