Digital Forensics Associate — Investigations & Incident Response

Stout Risius Ross, LLC; Chicago (IL); On-site; USD 74,000 - 135,000; Full time

Job summary

Stout Risius Ross, LLC seeks an Associate to perform forensic acquisition and analysis of digital devices supporting investigations and incident response in Chicago. You will preserve evidence from computers, mobile devices, cloud accounts, and removable media, and analyze artifacts to reconstruct user activity.

You will maintain chain of custody, write clear reports for technical and non-technical audiences, and assist in eDiscovery matters.

Qualifications

• 2-4 years of hands-on digital forensics or incident response experience.
• Bachelor’s degree in cybersecurity, computer science, digital forensics, or equivalent experience.
• Proficiency with at least one major forensic suite (EnCase, FTK, Magnet AXIOM, Cellebrite, or X-Ways).
• Working knowledge of Windows, macOS, and Linux file systems and artifacts.
• Understanding of evidence handling, forensic imaging, and write-blocking.
• Strong written and verbal communication skills.
• Ability to work independently and manage multiple cases.
• Certifications such as GCFE, GCFA, CFCE, EnCE, ACE, or CCE preferred.
• Mobile forensics and cloud forensics experience (M365, Google Workspace, AWS) preferred.
• Basic scripting skills (Python, PowerShell) preferred.
• Familiarity with memory forensics and malware triage preferred.
• Prior experience writing expert or court-ready reports preferred.

Responsibilities

• Acquire and preserve evidence from computers, mobile devices, cloud accounts, and removable media using forensically sound methods.
• Analyze file systems, registry artifacts, browser and email data, logs, and application data to reconstruct user activity.
• Maintain chain of custody and detailed case documentation.
• Write clear, accurate reports and summaries for technical and non-technical audiences.
• Support incident response, insider threat, fraud, and eDiscovery matters.
• Provide testimony or technical declarations when required.
• Assist in reviewing junior examiners’ work and validating tools and methods.

Skills

Digital forensics

Incident response

Written communication

Independent work

Education

Bachelor's degree in cybersecurity, computer science, digital forensics, or equivalent experience

Tools

EnCase

FTK

Magnet AXIOM

Cellebrite

X-Ways

Job description

Stout Risius Ross, LLC seeks an Associate to perform forensic acquisition and analysis of digital devices supporting investigations and incident response in Chicago. You will preserve evidence from computers, mobile devices, cloud accounts, and removable media, and analyze artifacts to reconstruct user activity.

You will maintain chain of custody, write clear reports for technical and non-technical audiences, and assist in eDiscovery matters.