Digital Forensic Extraction Lead

Sprymethods; Linthicum (MD); On-site; USD 120,000 - 150,000; Full time

Job summary

Spry Methods is seeking a Forensic Acquisition and Extraction Lead to direct all imaging and data extraction activities in the Cyber Forensics Laboratory (CFL). This role manages the Imaging and Extraction section and provides technical oversight for staff and workflows.

The candidate will maintain chain-of-custody, ensure tasks meet PWS requirements, and serve as the government technical point of contact. A strong background in image acquisition and tool validation is essential.

Qualifications

• TS/SCI clearance eligibility.
• EnCE/GCFE/DFE or equivalent certification approved by COR.
• 7+ years hands-on digital forensics experience, incl. 5+ years in evidence acquisition, imaging, and data extraction.

Responsibilities

• Lead forensic imaging, evidence acquisition, and data extraction operations.
• Direct management and technical oversight of Imaging and Extraction section personnel.
• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction.
• Maintain chain-of-custody documentation and evidence accountability.
• Ensure imaging and extraction tasks align with the PWS.
• Oversee testing/validation of forensic imaging tools and write-blockers.
• Monitor quality and efficiency of team performance.
• Serve as primary Government technical point of contact for imaging/extraction activities.
• Identify and communicate technical, programmatic, and resource limitations.

Skills

Digital forensics

Team leadership

Imaging tools testing

Education

EnCE

DFE

GCFE

Tools

EnCase

Write-blockers

Job description

Spry Methods is seeking a Forensic Acquisition and Extraction Lead to direct all forensic imaging and data extraction activities in the Cyber Forensics Laboratory (CFL). This position manages the Imaging and Extraction section and gives its staff technical oversight. It is responsible for evidence acquisition from hard drives, mobile devices, and IoT devices, and for running laboratory workflows and maintaining chain-of-custody documentation.

Responsibilities

• Lead forensic imaging, evidence acquisition, and data extraction operations.
• Provide direct management and technical oversight of Imaging and Extraction section personnel.
• Oversee laboratory workflows supporting evidence acquisition, imaging, and extraction.
• Maintain accurate chain-of-custody documentation and evidence accountability.
• Ensure imaging and extraction tasks are completed in accordance with the PWS.
• Oversee testing and validation of forensic imaging tools and write-blockers.
• Monitor the quality and efficiency of team performance.
• Serve as the primary Government technical point of contact for imaging and extraction activities.
• Proactively identify and communicate technical, programmatic, and resource limitations.

Qualifications

• TS/SCI clearance eligible.
• Active DFE, GCFE, EnCase Certified Examiner (EnCE), or equivalent certification approved by the COR.
• At least seven years of hands‑on digital forensics experience, including at least five years focused on evidence acquisition, forensic imaging, and data extraction from media such as hard drives, mobile devices, and IoT devices.
• At least three years of leadership or supervisory experience within the last five years managing a digital forensics team, laboratory workflows, and chain‑of‑custody documentation.
• Demonstrated experience within the last three years testing and validating forensic imaging tools and write‑blockers.