Digital Forensics Lead

SAIC; Bethesda (MD); On-site; USD 140,000 - 190,000; Full time

Job summary

SAIC is seeking a Digital Forensics Lead to serve as the senior technical and managerial authority for all digital forensics activities under an Intelligence Community program. The role requires TS/SCI, polygraph readiness, and leadership of DFIR teams, with on-site work in Bethesda, MD and travel as needed.

You will oversee imaging, data extraction, and host-based examinations, ensure chain of custody, and drive ISO 17025-based quality and accreditation activities while collaborating across

Qualifications

• 7+ years in digital forensics including evidence acquisition and data extraction across Windows, Linux, macOS
• 5+ years in advanced forensic disciplines: network intrusion, malware, memory analysis
• 3+ years in leadership or supervisory roles managing a DFIR team and workflows
• Active TS/SCI clearance and ability to pass polygraph
• Demonstrated experience testing and validating forensic imaging tools and write-blockers

Responsibilities

• Lead Digital Forensics and Incident Response activities across the program
• Oversee forensic imaging, data extraction, and host-based examination across media types
• Maintain chain of custody documentation and asset accountability per law and SOPs
• Support and sustain laboratory accreditation under ISO/IEC 17025 including audits
• Collaborate across program functions to maximize intelligence value

Skills

DFIR leadership

Incident response

Laboratory workflows

Documentation

Cross-functional collaboration

Education

Bachelor's degree in Intelligence Studies

Bachelor's degree in Computer Science

Bachelor's degree in Electrical Engineering

Tools

FTK

EnCase

X-Ways

Job description

SAIC is seeking a Digital Forensics Lead to serve as the senior technical and managerial authority for all digital forensics activities performed under an Intelligence Community program. This position provides oversight of forensic examination personnel, manages laboratory workflows, and ensures the timely, technically defensible extraction and analysis of data from digital devices and media in support of the customer's intelligence mission.

Work is performed on site in: Bethesda, MD, with CONUS/OCONUS travel as required.

The Digital Forensics Lead will be responsible for:

• Leading Digital Forensics and Incident Response (DFIR) activities, including network intrusion analysis, malware forensics, and memory analysis.
• Overseeing forensic imaging, data extraction, and host-based examination across a variety of media types.
• Maintaining chain of custody documentation and asset accountability in accordance with applicable Federal law, UCMJ, and program SOPs.
• Supporting and sustaining laboratory accreditation under ISO/IEC 17025, including SOP development, internal audits, and quality assurance procedures.
• Collaborating across program functional areas to maximize intelligence value from complex, multi-disciplinary requirements.

Active TS/SCI is required to be considered for this role.

Willing and able to pass a polygraph.

Bachelor's degree or higher in Intelligence Studies, Computer Science, Electrical Engineering, Biometrics, Criminal Justice, or related field.

Seven (7) years of experience in digital forensics, including evidence acquisition, forensic imaging, data extraction, and host-based examination across multiple operating systems (Windows, Linux, macOS).

Five (5) years of experience in advanced forensic disciplines, including network intrusion analysis, malware forensics, memory analysis, and/or mobile/IoT device exploitation.

Three (3) years of experience in a leadership or supervisory role managing a digital forensics team, assigning cases, overseeing laboratory workflows, and maintaining chain of custody documentation.

Demonstrated experience testing and validating forensic imaging tools and write-blockers, and utilizing common examination platforms including FTK, EnCase, and X-Ways.

Required Certifications (at least one):

DC3 Cyber Training Academy Digital Forensic Examiner (DFE), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Forensic Examiner (GCFE), GIAC Certified Incident Handler (GCIH), EnCase Certified Examiner (EnCE), or equivalent certification approved by the COR.

Desired:

• Experience supporting IC or DoD forensics missions in a SCIF environment compliant with ICD 705.
• Familiarity with DC3 Terms of Reference and forensic standards applicable to DoD digital exploitation programs.
• Experience with AI/ML-assisted forensic analysis or large-scale data processing pipelines in support of intelligence production.
• Prior experience supporting national-level digital exploitation programs.