Investigator, Digital Forensics

Gijima Holdings; Gauteng; On-site; ZAR 600,000 - 900,000; Full time

Job summary

Gijima Holdings is seeking an experienced Digital Forensics professional to lead investigations across endpoints, cloud, and networks. You will gather and preserve evidence, perform complex analyses and produce detailed reports for senior stakeholders.

The role requires 5–7 years of experience, strong knowledge of forensic tools, and the ability to present findings in regulatory settings. This is a full-time on-site position in Gauteng, South Africa.

Qualifications

• Bachelor's degree in Digital Forensics, Cyber Security, Computer Science, Information Security or related field.
• 5–7 years' experience in Digital Forensics, Investigations, Incident Response or related discipline.
• Experience conducting complex investigations across multiple tech environments.
• Experience preparing forensic reports and presenting findings to stakeholders or regulators.

Responsibilities

• Gather, preserve, extract and analyse digital evidence from endpoints, servers, mobile devices, cloud and networks.
• Recover deleted, hidden, encrypted or damaged data using forensic methods and tools.
• Analyse user activity, emails, logs and artefacts to establish timelines and indicators of compromise.
• Prepare detailed forensic reports, findings and recommendations for stakeholders.
• Maintain chain of custody and secure storage of digital evidence.
• Conduct endpoint, cloud and network forensic investigations using industry-standard technologies.
• Apply forensic methodologies to identify, collect and preserve evidence with integrity.
• Stay updated on emerging digital threats and investigative techniques.
• Provide expert evidence or testimony when required and support regulatory proceedings.

Education

Bachelors in Digital Forensics

Tools

EnCase

FTK

Magnet AXIOM

Cellebrite

MSAB XRY

Microsoft Sentinel

Microsoft Defender

Microsoft Purview

Job description

Key Responsibilities

1. Data Management and Analysis

• Gather, preserve, acquire, extract and analyse digital evidence from endpoints, servers, mobile devices, cloud environments, Microsoft 365, network infrastructure and other digital sources.
• Recover deleted, hidden, encrypted or damaged data using approved forensic methodologies and industry-standard tools.
• Conduct forensic analysis of user activity, email communications, authentication records, cloud audit logs, browser activity and application artefacts.
• Analyse digital evidence to establish timelines, user activity, indicators of compromise and other relevant investigative findings.
• Prepare detailed forensic reports, findings, conclusions, recommendations, statistics and trend analysis for relevant stakeholders.
• Maintain an accurate chain of custody and ensure the secure storage, management, retention and disposal of digital evidence in accordance with organisational requirements.

2. Technology and Digital Forensics

• Conduct endpoint, mobile, cloud, network, memory and malware forensic investigations.
• Perform forensic investigations across Microsoft Azure, Microsoft 365, AWS, Google Cloud Platform and SaaS environments.
• Utilise digital forensic, eDiscovery and security technologies such as EnCase, FTK, Magnet AXIOM, Cellebrite, MSAB XRY, Microsoft Sentinel, Microsoft Defender and Microsoft Purview.
• Apply appropriate forensic methodologies to identify, collect, preserve and analyse evidence while maintaining its integrity and admissibility.
• Stay abreast of emerging forensic technologies, techniques, digital threats and investigative methodologies.

3. Risk, Regulatory and Compliance

• Conduct digital forensic investigations in accordance with applicable legislation, regulatory requirements, organisational policies and evidentiary standards.
• Perform root cause analysis to identify control weaknesses, vulnerabilities and contributing factors.
• Recommend corrective and preventative actions to reduce the likelihood of recurrence.
• Prepare affidavits, witness statements, forensic reports and other evidential documentation for disciplinary, civil, regulatory and criminal proceedings.
• Present and explain forensic findings to senior stakeholders, legal representatives, investigators and other relevant parties.
• Provide expert evidence or testimony at disciplinary hearings, tribunals, regulatory proceedings or court proceedings when required.
• Identify and elevate emerging digital crime trends, risks, vulnerabilities and significant investigative findings.

Qualifications and Experience

Minimum Qualification

• Bachelor’s degree in Digital Forensics, Cyber Security, Computer Science, Information Security, Information Systems or a related field.

Minimum Experience

• 5–7 years’ experience in Digital Forensics, Digital Investigations, Incident Response, Cyber Investigations or a closely related discipline.
• Demonstrated experience conducting complex digital forensic investigations across multiple technology environments.
• Experience gathering, preserving and analysing digital evidence while maintaining proper chain-of-custody procedures.
• Experience preparing evidential/forensic reports and presenting findings to senior stakeholders, legal representatives, regulators or other relevant parties.
• Experience providing forensic evidence or testimony in disciplinary, regulatory, civil or criminal proceedings would be advantageous.

Preferred Certifications

• GIAC: GCFA, GCFE, GNFA, GCTI
• Digital Forensics: EnCE, CFCE, CCE, CHFI
• Information Security: CISSP, CISM
• Microsoft Security Certifications
• AWS Certified Security – Specialty
• Google Professional Cloud Security Engineer