Cyber Forensic Analyst II; Springfield, NJ

Cyber Forensic Analyst II

Hybrid:
Springfield, NJ

The Cyber Forensic Analyst II conducts end-to-end digital forensic examinations in support of IRS Criminal Investigation (CI) and the Cyber Crime Unit (CCU). This role performs forensic acquisition, preservation, processing, and analysis across computers, mobile devices, removable media, cloud artifacts, and cryptocurrency-related evidence; maintains strict chain‑of‑custody; documents methodologies/results; and produces court‑ready reports to support agents, prosecutors, and interagency partners. The analyst contributes to lab hygiene, tool stewardship, and case/knowledge management within CI’s collaboration environment.

• Digital Evidence & Lab Operations
  • Execute evidence preservation and chain‑of‑custody procedures; maintain custody forms, hashes, and audit trails.
  • Perform forensic imaging and triage of digital media (workstations, servers, VMs, mobile devices, removable media) using validated methods and write‑blockers.
  • Process and analyze artifacts (file systems, logs, registry, browser, cloud sync, app data, memory, crypto wallets/keys, transaction artifacts) and reconstruct timelines.
  • Generate court‑ready reports that clearly explain methods, findings, and limitations; prepare demonstratives for briefings and legal proceedings.
  • Maintain lab hygiene: tool updates/validation logs, job notes, case notebooks, SOP adherence, and evidence storage integrity.
• Case Support & Collaboration
  • Work with Special Agents/Analysts to scope examinations, define questions, and translate findings into investigative leads.
  • Support CCU and field offices; coordinate with HQ stakeholders and interagency partners as directed.
  • Use CI collaboration tools—e.g., SharePoint for documentation and Smartsheet for tasking/progress tracking—as required by program management practices.
• Program & Administrative (as directed by Cyber HQ)
  • Assist with CI-provided tool/license stewardship relevant to forensic operations; run usage reports and maintain access logs where applicable.
  • Maintain electronic/paper files, draft correspondence/memoranda, coordinate meetings/space, and maintain contact lists/interagency documentation.
  • Comply with all IRS security measures, regulations, directives, and subcontract/prime requirements.

• U.S. citizen able to obtain/maintain at least a NACI background; willingness to undergo higher Public Trust (L5/L6) or national security vetting as required.
• 3–5+ years conducting digital forensic examinations, including evidence handling, imaging, analysis, and reporting.
• Proficiency with one or more forensic suites (e.g., EnCase, FTK, X‑Ways, Magnet AXIOM), mobile/cloud tools (e.g., Cellebrite), and memory/malware triage (e.g., Volatility).
• Strong technical writing and briefing skills; ability to translate low-level artifacts into law‑enforcement‑ready narratives.
• Familiarity with SharePoint and Smartsheet for documentation and task tracking.

• Prior support to IRS CI or other federal LE/investigative agencies, especially cases involving cyber/cryptocurrency components.
• Recognized credentials (e.g., GCFA, CFCE, EnCE, CCME, ACE) or equivalent demonstrated experience.
• Experience preparing for expert testimony and responding to discovery/Daubert challenges.
• Experience administering investigative tool entitlements/licenses and producing usage/access reports.

Only shortlisted candidates are going to be contacted.

Paid sick leave, Medical/Dental (optional), 401(k) Retirement Plan (optional), Employer‑Paid Life Insurance, Employer‑Paid Short Term Disability, Optional Life Insurance.

ELYON International, Inc. is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.