Senior Digital Forensics Examiner - ITS5

State of Minnesota; Saint Paul (MN); Hybrid; USD 83,000 - 142,000; Full time

Job summary

The State of Minnesota, through Minnesota IT Services, seeks a Senior Digital Forensics Examiner to provide advanced digital forensics services for executive branch agencies and to mentor staff within the MDFL. The role focuses on scoping, data acquisition, analysis, reporting, and testimony for complex investigations. Based in St.

Paul, hybrid telework is eligible. The position emphasizes collaboration across teams, development of lab procedures, and ongoing research into new forensic

Qualifications

• Minimum of five (5) years IT experience in digital forensics with investigative work.
• Experience with live system, dead-box, mobile, and/or network forensics and investigations.
• Ability to work with various hardware types and IT concepts relevant to forensics.
• Strong communication and customer-focused problem-solving.
• Experience with multiple operating systems and file systems as they relate to forensic investigations.

Responsibilities

• Perform advanced digital forensics services for executive branch agencies.
• Provide digital forensic consultation for State agencies and limited third-party engagements.
• Manage digital forensics examinations through full lifecycle including testimony.

Skills

Digital forensics knowledge

Investigations experience

Communication skills

Mentoring/leadership

Education

Bachelor's degree in IT or related field

Tools

Magnet Axiom

EnCase

Volatility

Cellebrite UFED/Physical Analyzer

Cellebrite Digital Collector

WinHex Specialist

Forensic Explorer

Job description

Working Title: Senior Digital Forensics Examiner

Job Class: Information Technology Specialist 5

Agency: Minnesota IT Services

• Job ID : 94402

• Location : St. Paul

• Telework Eligible : Yes, LI-Hybrid

• Full/Part Time : Full-Time

• Regular/Temporary : Unlimited

• Who May Apply : Open to all qualified job seekers

• Date Posted : 09/01/2026

• Closing Date : 09/10/2026

• Hiring Agency/Seniority Unit : Minnesota IT Services

• Division/Unit : Enterprise Security

• Work Shift/Work Hours : Day Shift

• Days of Work : Monday - Friday

• Travel Required : No

• Salary Range: $39.73 - $67.92 / hourly; $82,956 - $141,816 / annually

• Job Class Option : Information Security

• Classified Status : Classified

• Bargaining Unit/Union : 214 - MN Assoc of Professional Empl/MAPE

• FLSA Status : Exempt - Professional

• Designated in Connect 700 Program for Applicants with Disabilities (https://mn.gov/mmb/careers/diverse-workforce/people-with-disabilities/connect700/) : Yes

The work you'll do is more than just a job.

At the State of Minnesota, employees play a critical role in developing policies, providing essential services, and working to improve the well-being and quality of life for all Minnesotans. The State of Minnesota is committed to equity and inclusion, and invests in employees by providing benefits, support resources, and training and development opportunities.

Join the 2,800+ professionals of Minnesota IT Services (https://mn.gov/mnit/about-mnit/careers/) (MNIT) who connect Minnesotans to services that will improve their lives. This position will be part of the Enterprise Security team, which embeds security protection statewide.

The Senior Digital Forensics Examiner (SDFE) assumes an advanced technical role within the MNIT Digital Forensics Laboratory (MDFL) to provide the State of Minnesota with digital forensics services based on established Enterprise policies, programs, laws, and regulations.

The SDFE conducts digital forensics investigations for internal investigations and security investigations. The SDFE is responsible for scoping, data acquisition, processing, advanced analysis, and reporting on the most complex and sensitive cases handled by the MNIT Digital Forensics Laboratory. This position may assist other government entities with investigations as well as consult with them on digital forensics and investigative matters. This position uses tools and investigative techniques to assess, acquire, analyze, document, and report on digital forensic artifacts, system-level details, metadata, and other investigative material associated with internal and security investigations. The incumbent conducts laboratory maintenance, develops laboratory procedures and processes, and performs research and testing on new technologies. The SDFE plays an integral role in mentoring and assisting other staff within the MNIT Digital Forensics Laboratory (MDFL).

You will be part of an forensics team that engages in a wide variety of important work. You will play a key role within the MNIT Digital Forensics Laboratory (MDFL) and assist with improving services, automation, implementing new technologies, developing documentation, and building key relationships with customers while continuing to expand your digital forensics and investigative knowledge.

This position requires onsite work at the MNIT Digital Forensics Laboratory (MDFL) located in St. Paul, MN; remote work may be available in accordance with State policy and laboratory operational needs.

Responsibilities

• Perform advanced digital forensics services for executive branch agencies to acquire, document, and report on digital forensic artifacts, system-level details, metadata, and other investigative material associated with internal investigations, security investigations, and other investigative requests.
• Provide digital forensic consultation and perform digital forensic services for State agencies and, as appropriate, limited third-party engagements, including evidence identification, forensic collection considerations, investigative approach, forensic tools and methodologies, and documentation related to digital forensic examinations.
• Manage digital forensics examinations through the entire lifecycle, including case planning, intake, acquisition, processing, examination, reporting and presentation, and testimony.
• Provide technical recommendations for developing enterprise-wide forensic standards and practices.
• Develop and document laboratory processes and procedures and provide training to laboratory staff as appropriate.
• Act as an expert witness on digital forensic examinations, including interpreting and presenting forensic findings and reports in legal proceedings. Assist other laboratory staff in deposition and testimony preparation and work with legal counsel as needed.
• Maintain the MNIT Digital Forensics Laboratory, including performing validations, developing forensic processes and procedures, and troubleshooting and resolving technical issues.
• Mentor other laboratory staff and serve as a team lead within the MNIT Digital Forensics Laboratory.
• Provide training and advice on forensic-related matters to a wide variety of audiences, including MNIT staff, agency legal teams, agency Human Resources teams, vendors, and other government partners.
• Partner with security teams as needed on security investigations to help determine investigative scope and impact.
• Research and stay abreast of new digital forensic methods, tools, processes, and best practices. Play a key role in advanced research and testing and develop standards for conducting research and testing.
• Understand MNIT Digital Forensics Laboratory policies, procedures, and processes and act as a subject matter expert in this area for other laboratory staff.

This position was previously announced on May 27, 2026. If you previously applied for this job opening, you do not need to reapply.

This position requires an employee to work onsite at 600 Cedar St, Minnesota at least 50% [or more or less if space limitations remain] of the time, with limited telework available. Telework (https://mn.gov/mmb-stat/policies/1422-telework.pdf) eligibility depends on residence:

• Candidates living in Minnesota or within 50 miles of the worksite in a bordering state (Iowa, North Dakota, South Dakota, and Wisconsin) may telework up to 50%.
• Minnesota residents living more than 50 miles from the worksite may be eligible to telework more than 50%.
• Candidates living 50 miles or more from the worksite in a bordering state may work onsite 100% or may be telework eligible if relocating within 50 miles.

Minimum Qualifications

To qualify, candidates must clearly show all of the following qualifications in their resume. Resume tips available here (https://mn.gov/mnit/about-mnit/careers/hiringprocess.jsp) :

Position requires a minimum of five (5) years of IT related experience in in digital forensics, role that includes experience supporting investigative work (e.g., internal, corporate, or criminal investigations).

Experience must include:

• Knowledge of digital forensics methodologies, industry standards, and best practices.
• Experience performing live system forensics, dead-box forensics, mobile forensics, and/or network forensics and conducting investigations, including scoping, data acquisition, data processing, forensic analysis, and reporting.
• Working knowledge and experience with computer hardware and the ability to work with a wide variety of hardware types, including desktops, laptops, tablets, smartphones, and Internet-of-Things (IoT) devices.
• Knowledge of general IT concepts and technologies such as databases, networking, scripting, system administration, application and system design, backup technologies, email systems, cloud services, and IoT devices.
• Experience with multiple operating systems (e.g., Windows, Linux, macOS) and multiple file systems (e.g., NTFS, EXT3/4, HFS, Android) as they relate to forensic investigations.
• Demonstrated ability to communicate clearly and effectively in a manner that facilitates mutual understanding.
• Customer-focused approach grounded in active listening, empathy, and solution-oriented problem-solving to deliver positive user experiences.

Education in Information Technology (IT) or an IT related field may substitute for experience as follows: a master’s degree for eighteen (18) months of experience; a bachelor’s degree for one (1) year; and an associate’s degree for six (6) months.

Preferred Qualifications

• Experience with digital forensic tools such as Magnet Axiom, EnCase, Volatility, Cellebrite UFED / Physical Analyzer / Inseyets, Cellebrite Digital Collector, WinHex Specialist, Forensic Explorer, or similar forensic tools, as well as experience with Microsoft cloud environments, including Microsoft Purview, Azure, Entra ID, and Microsoft 365 services, with an understanding of how these platforms store, manage, and expose data relevant to digital forensic investigations and data acquisition.
• Experience with specialized digital forensic domains, including network forensics (e.g., log analysis and data correlation), mobile device forensics, and Internet-of-Things (IoT) investigations involving the identification, acquisition, and analysis of data.
• Experience with case management systems, evidence management systems, quality control processes and systems used to support digital forensic investigations and laboratory operations.
• Ability to lead, collaborate within a team environment, and adapt to evolving investigative priorities, with high attention to detail, strong analytical skills, high ethical standards and professionalism, and excellent written and verbal communication skill.

Strongly Preferred Qualifications

• Certifications such as CFCE (IACIS), CCE, ENCE, GCFA, GNFA, Cellebrite certifications, or other relevant digital forensic certifications; foundational or advanced security certifications (e.g., CompTIA A+, Network+, Security+, CISSP) are also considered beneficial.
• Experience working in a structured digital forensics laboratory environment, including laboratory maintenance, validations, adherence to established policies, procedures, and standards, and participation in quality control processes (e.g., peer and technical review) to ensure defensible and repeatable forensic practices; familiarity with ANAB accreditation or similar frameworks is beneficial.
• Experience supporting internal, corporate, security or criminal investigations, and having the ability to compose clear, concise, and comprehensive technical documentation and digital forensic investigative reports tailored to a variety of audiences, and experience supporting or providing testimony in legal proceedings (e.g., depositions, hearings, or trials) in addition to working with subpoenas, warrants, or other legal processes.

Additional Requirements

It is the policy of Minnesota IT Services that a successful candidate must pass all legally required checks prior to employment which may consist of the following:

• SEMA4 Records Check (applies to current and past state employees only)
• Criminal History Check
• Reference Check
• Social Security and Address Verification
• Education Verification
• CJIS Background Check
• Other legally required checks

Minnesota IT Services does not participate in the federal E-Verify program. Minnesota IT Services is unable to sponsor applicants for work visas, including F-1 STEM OPT extensions, and cannot complete Form I-9 or any other documentation requiring employer participation in E-Verify. All applicants must be legally authorized to work in the United States at the time of application.

AN EQUAL OPPORTUNITY EMPLOYER

Minnesota State Colleges and Universities is an Equal Opportunity employer/educator committed to the principles of diversity. We prohibit discrimination against qualified individuals based on their race, sex, color, creed, religion, age, national origin, disability, protected veteran status, marital status, status with regard to public assistance, sexual orientation, gender identity, gender expression, or membership in a local commission as defined by law. As an affirmative action employer, we actively seek and encourage applications from women, minorities, persons with disabilities, and individuals with protected veteran status.

Reasonable accommodations will be made to all qualified applicants with disabilities. If you are an individual with a disability who needs assistance or cannot access the online job application system, please contact the job information line at 651-259-3637 or email [e-mail] . Please indicate what assistance is needed.