Digital Forensic Investigator

Avalon; Buffalo (NY); Hybrid; USD 70,000 - 110,000; Full time

Job summary

Avalon is seeking a Digital Forensic Investigator to support examinations involving computers, mobile devices, cloud platforms, and digital evidence in a hybrid Buffalo, NY environment.

Ideal candidates have 1–5 years of forensic experience, relevant certifications, and a strong ability to document findings clearly. The role includes evidence acquisition, analysis, reporting, and ongoing professional growth in a team-oriented lab setting.

Qualifications

• Bachelor’s degree in Digital Forensics, Computer Science, Cybersecurity, IT, or related field, or equivalent professional experience.
• 1–5 years of experience conducting digital forensic examinations or related investigative work.
• Industry-recognized forensic certification such as Cellebrite Certified Operator (CCO), Cellebrite Certified Physical Analyst (CCPA), GIAC Certified Forensic Examiner (GCFE), or equivalent.
• Foundational knowledge of Windows and macOS forensic artifacts, SQLite databases, and artifact interpretation.

Responsibilities

• Acquire, preserve, and process digital evidence while maintaining chain of custody.
• Conduct forensic examinations of Windows and macOS systems.
• Analyze SQLite databases and related artifacts.
• Assist with mobile device examinations and artifact interpretation.
• Prepare forensic reports and investigative summaries.
• Maintain laboratory equipment and evidence inventory.
• Support litigation, corporate investigations, incident response, and eDiscovery needs.
• Collaborate in quality assurance and peer review processes.

Skills

Analytical thinking

Attention to detail

Strong organizational skills

Clear documentation

Education

Bachelor’s degree or equivalent experience

Tools

PowerShell

Python

SQL

Cellebrite

Magnet AXIOM

EnCase

FTK

X-Ways

Job description

Hybrid with a combination of on-site laboratory work in Buffalo, NY and remote work based on operational and case requirements.

Position Overview

We are seeking a motivated Digital Forensic Investigator to support forensic examinations involving computers, mobile devices, cloud platforms, and digital evidence. This position is ideal for an early-career to mid-level forensic professional seeking hands-on experience across a variety of investigations while working alongside experienced forensic examiners.

The successful candidate will assist with evidence acquisition, forensic analysis, artifact interpretation, reporting, and laboratory operations. Candidates should possess strong analytical skills, attention to detail, and a foundational understanding of forensic methodologies relating to Windows, macOS, and SQLite-based artifacts.

Required Qualifications

• Bachelor's degree in Digital Forensics, Computer Science, Cybersecurity, Information Technology, or related field, or equivalent professional experience.
• One to five years of experience conducting digital forensic examinations or related investigative work.
• Industry-recognized forensic certification such as:
• Cellebrite Certified Operator (CCO)
• Cellebrite Certified Physical Analyst (CCPA)
• GIAC Certified Forensic Examiner (GCFE)
• Or an equivalent forensic certification demonstrating practical examination competency.
• Foundational knowledge of:
• Windows forensic artifacts
• macOS forensic artifacts
• SQLite databases and forensic analysis techniques
• Experience examining digital evidence using industry-standard forensic tools.
• Ability to document findings clearly and accurately.
• Strong organizational skills and attention to detail.
• Ability to pass background screening as required.
• Ability to testify under oath with no prior impeachments

Preferred Qualifications

• Experience with Cellebrite Physical Analyzer, Magnet AXIOM, EnCase, FTK, X-Ways, or similar forensic platforms.
• Knowledge of cloud-based evidence sources and common synchronization platforms.
• Familiarity with scripting or automation using PowerShell, Python, or SQL.
• Experience preparing reports for legal, corporate, or investigative audiences.

Key Responsibilities

• Acquire, preserve, and process digital evidence while maintaining chain of custody.
• Conduct forensic examinations of Windows and macOS systems.
• Analyze SQLite databases and related artifacts.
• Assist with mobile device examinations and artifact interpretation.
• Identify and document relevant user activity, application usage, file access, and system events.
• Prepare forensic reports and investigative summaries.
• Maintain forensic laboratory equipment, evidence inventory, and documentation.
• Support litigation, corporate investigations, incident response, and eDiscovery matters as needed.
• Participate in quality assurance and peer review processes.
• Hybrid role with regular in-office laboratory presence in Buffalo, NY.
• Remote work available based on operational requirements and case demands.
• Collaborative team environment supporting corporate, civil, and criminal investigations.
• Opportunity for technical growth, mentorship, and certification development.