Digital Forensic Extraction Lead

Spry Methods, Inc.; Linthicum (MD); On-site; USD 200,000 - 225,000; Full time

Job summary

Spry Methods is seeking a Forensic Acquisition and Extraction Lead to direct all imaging and data extraction activities within the Cyber Forensics Laboratory. The role will manage the Imaging and Extraction section and provide technical oversight to staff, ensuring evidence acquisition from hard drives, mobile devices, and IoT devices.

Laboratory workflows will be run with strict chain-of-custody documentation and PWS compliance.

Qualifications

• Seven+ years of hands-on digital forensics experience, with at least five years in evidence acquisition, imaging, and data extraction from hard drives, mobile devices, and IoT devices.
• Three+ years in leadership or supervisory roles within the last five years managing a digital forensics team, workflows, and chain-of-custody documentation.
• Experience in testing and validating forensic imaging tools and write-blockers within the last three years.

Responsibilities

• Lead forensic imaging, evidence acquisition, and data extraction operations.
• Provide direct management and technical oversight of Imaging and Extraction section personnel.
• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction.
• Maintain accurate chain-of-custody documentation and evidence accountability.
• Ensure imaging and extraction tasks comply with contractual and program requirements.
• Oversee testing and validation of imaging tools and write-blockers.
• Serve as the primary Government technical point of contact for imaging and extraction activities.

Skills

Digital forensics leadership

Laboratory workflow management

Chain-of-custody documentation

Education

EnCE Certification

Tools

EnCase

Forensic imaging tools

Write-blockers

Job description

Spry Methods is seeking a Forensic Acquisition and Extraction Lead to direct all forensic imaging and data extraction activities in the Cyber Forensics Laboratory (CFL). This position manages the Imaging and Extraction section and gives its staff technical oversight. It is responsible for evidence acquisition from hard drives, mobile devices, and IoT devices, and for running laboratory workflows and maintaining chain-of-custody documentation.

What Your Day-To-Day Looks Like (Position Responsibilities):

• Lead forensic imaging, evidence acquisition, and data extraction operations.
• Provide direct management and technical oversight of Imaging and Extraction section personnel.
• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction.
• Maintain accurate chain-of-custody documentation and evidence accountability.
• Ensure imaging and extraction tasks are completed in accordance with the PWS.
• Oversee testing and validation of forensic imaging tools and write-blockers.
• Monitor the quality and efficiency of team performance.
• Serve as the primary Government technical point of contact for imaging and extraction activities.
• Proactively identify and communicate technical, programmatic, and resource limitations.

What You Need to Succeed (Minimum Requirements):

• TS/SCI clearance eligible.
• Active DFE, GCFE, EnCase Certified Examiner (EnCE), or equivalent certification approved by the COR.
• At least seven years of hands-on digital forensics experience, including at least five years focused on evidence acquisition, forensic imaging, and data extraction from media such as hard drives, mobile devices, and IoT devices.
• At least three years of leadership or supervisory experience within the last five years managing a digital forensics team, laboratory workflows, and chain-of-custody documentation.
• Demonstrated experience within the last three years testing and validating forensic imaging tools and write-blockers.

$200,000 - $225,000 a year

Final compensation will be based on experience, qualifications, certifications, clearance level, and contract requirements. This position is contingent upon contract award.