Digital Forensic Specialist

SNG GrantThornton; Gauteng; On-site; ZAR 1,200,000 - 1,700,000; Full time

Job summary

SNG Grant Thornton is seeking a Senior Digital Forensic Specialist in Gauteng to lead complex investigations, oversee forensic work, and mentor junior practitioners. The role focuses on acquiring and analysing digital evidence, reporting findings, and coordinating with investigators, legal teams, and clients to deliver defensible conclusions.

You will apply advanced forensic methods across endpoints, servers, mobile devices, and email, ensuring timelines and quality standards are met while

Qualifications

• Degree in Computer Science, Information Systems, Digital Forensics, Cyber Security, IT or related field.
• Postgraduate qualification in a relevant discipline is advantageous.

Responsibilities

• Acquire, preserve, and forensic image digital evidence from endpoints, servers, mobile devices and media per standards.
• Maintain chain-of-custody documentation and ensure evidence integrity and confidentiality.
• Plan and execute evidence collection for complex investigations.
• Provide guidance to junior team members on procedures.
• Conduct advanced forensic analysis to identify fraud, misconduct, data breaches, unauthorised activity, and other threats.
• Develop timelines and correlate evidence from multiple sources to support findings.
• Review analysis and provide technical guidance on complex investigations.
• Provide digital forensic support across investigations and liaise with investigators, legal teams and clients.
• Prepare clear forensic reports covering methodologies, evidence, findings and conclusions.
• Present findings to investigators, legal teams and stakeholders.
• Mentor junior personnel and oversee forensic activities to ensure quality and timelines.

Skills

Digital forensics

Leadership

Data analysis

Incident response

Communication

Education

Degree in Computer Science or Digital Forensics

Postgraduate qualification advantageous

Tools

Forensic tools

Evidence analysis

Job description

Role Purpose

To support and conduct digital forensic investigations by collecting, preserving, analysing, and reporting on digital evidence. The role focuses on uncovering fraud, misconduct, data breaches, and cyber-related incidents through the application of established digital forensic methodologies and tools.

This is a senior specialist role requiring extensive experience in leading complex digital forensic investigations, providing technical oversight and quality review of forensic work, and mentoring junior team members.

The Digital Forensic Specialist will be responsible for handling complex forensic matters, providing technical guidance to junior team members, and working closely with forensic investigators, legal teams, clients, and other stakeholders to deliver accurate, timely, and defensible forensic findings.

Key Responsibilities

Digital Evidence Handling

• Acquire, preserve, and forensically image digital evidence from endpoints, servers, mobile devices, and other digital media in accordance with established forensic standards.
• Maintain accurate chain-of-custody documentation and ensure the integrity, security, and confidentiality of all digital evidence.
• Plan and execute evidence collection activities for complex investigations.
• Provide guidance to junior team members on evidence acquisition, preservation, and handling procedures.

Forensic Analysis

• Conduct advanced forensic analysis of digital evidence to identify fraud, misconduct, data breaches, unauthorised activity, and other suspicious behaviour.
• Analyse email, file systems, operating systems, browsers, applications, logs, and other relevant digital artefacts, including the recovery of deleted or hidden data.
• Develop timelines and correlate evidence from multiple sources to establish facts and support investigative findings.
• Review forensic analysis and provide technical guidance on complex or sensitive investigations.

Investigations Support

• Provide digital forensic support across fraud, misconduct, cyber, litigation, regulatory, and other investigative matters.
• Work closely with investigators, legal teams, clients, and internal stakeholders to determine evidence requirements and appropriate forensic approaches.
• Provide specialist technical input on the interpretation and relevance of digital evidence.
• Manage assigned forensic activities and deliverables in line with agreed scope, quality standards, and timelines.

Cyber & Data Analytics

• Support cyber investigations and incident response through forensic acquisition, analysis, and identification of indicators of compromise and suspicious activity.
• Analyse system, security, application, and other relevant data to identify anomalies, trends, and potential threats.
• Apply data analytics, scripting, automation, and other appropriate technologies to enhance forensic investigations.
• Correlate digital forensic findings with other investigative and analytical information to support conclusions.

Reporting & Presentation

• Prepare clear, accurate, and defensible forensic reports covering methodologies, evidence examined, findings, and conclusions.
• Ensure findings are supported by appropriate evidence and meet required forensic and quality standards.
• Present and explain forensic findings clearly to investigators, clients, legal teams, and technical and non-technical stakeholders.
• Review forensic reports and support legal, disciplinary, regulatory, or other formal proceedings where required.

Team Support & Development

• Act as a senior technical specialist within the team, providing oversight, quality assurance, coaching, and mentorship to junior and intermediate digital forensic practitioners.
• Provide technical guidance, coaching, and mentoring to junior and intermediate digital forensic team members.
• Assist with the coordination and allocation of forensic activities and provide oversight on assigned work.
• Support quality assurance and adherence to forensic methodologies, procedures, and professional standards.
• Contribute to knowledge sharing and the continuous improvement of forensic processes, tools, and working practices.

Minimum Requirements

Qualifications

• Degree in Computer Science, Information Systems, Digital Forensics, Cyber Security, Information Technology, or a related field.
• A postgraduate qualification in a relevant discipline will be advantageous.

Experience

• 8+ years' experience in digital forensics, data analysis, IT audit, cyber investigations, incident response, or a related field.
• 3+ years' experience in a supervisory, team lead, or managerial capacity, with responsibility for guiding or managing team members and/or forensic assignments.
• Proven experience inend-to-end digital forensic investigations, from evidence acquisition through to analysis and reporting.
• Experience handlingcomplex fraud, misconduct, cyber, data breach, litigation, and regulatory matters.
• Strong practical knowledge offorensic tools, evidence analysis, and multiple digital environments, including endpoints, servers, mobile devices, and email.
• Experience providingtechnical guidance, reviewing forensic work, and engaging with multidisciplinary teams and senior stakeholders.
• Ability tomanage multiple investigations and competing prioritieswhile maintaining quality and attention to detail.

Certifications – Advantageous

• CISA – Certified Information Systems Auditor
• CHFI – Computer Hacking Forensic Investigator
• EnCE – EnCase Certified Examiner
• NUIX certification
• Cellebrite or similar mobile forensic certification
• Other recognised digital forensic application or cyber security certifications

Professional Memberships – Advantageous

• ACFE – Association of Certified Fraud Examiners
• IACIS – International Association of Computer Investigative Specialists
• Other recognised digital forensics, cyber security, audit, or investigation professional memberships

Key Skills & Competencies

• Advanced digital forensic analysis and investigation skills
• Strong understanding of digital evidence handling and chain-of-custody requirements
• Strong analytical and problem-solving abilities
• Good understanding of cyber security and incident response principles
• Ability to analyse and interpret large volumes of digital evidence
• Strong report-writing and presentation skills
• Ability to communicate technical findings clearly to non-technical stakeholders
• Ability to work independently on complex investigations
• Ability to provide guidance and mentorship to junior team members
• Strong attention to detail and commitment to evidence integrity
• Good stakeholder and client management skills
• Sound judgement, discretion, and professional integrity
• Ability to manage competing priorities and work under pressure