Senior Digital Forensic Examiner

This is a remote position.

About Cyber Centaurs

Cyber Centaurs is a digital forensics and incident response firm serving businesses, law firms, insurers, and other organizations facing complex cyber incidents, employee misconduct, data theft, and litigation-related matters. Our work is guided by a simple principle: Evidence Over Assumption. We use defensible forensic methods, clear reporting, and careful analysis to help clients establish the facts and make informed decisions. Cyber Centaurs is growing, and we are seeking an experienced forensic professional who can take ownership of investigations while helping us continue to develop a disciplined, efficient, and respected digital forensics practice.

Position Overview

The Senior Digital Forensic Examiner is a senior, hands-on investigative position responsible for independently conducting digital forensic examinations from evidence acquisition through final reporting. This individual will manage assigned matters, examine computers and other digital evidence, document findings, prepare clear and defensible reports, and communicate directly with attorneys, executives, clients, and other stakeholders. The examiner may also support affidavits, depositions, hearings, and expert-witness engagements. The successful candidate must be comfortable performing detailed technical work while also contributing to quality assurance, process development, examiner training, and the continued growth of the forensic practice. The position offers a potential advancement path into a future Forensics Practice Lead or Director of Digital Forensics role as the team and service line continue to grow.

Primary Responsibilities

• Independently manage digital forensic investigations from intake through completion.
• Acquire, preserve, process, and examine digital evidence using accepted forensic methods.
• Conduct forensic examinations of Windows computers, storage media, cloud data, email, and other relevant data sources.
• Investigate matters involving insider threats, employee data theft, trade-secret theft, unauthorized access, intellectual-property disputes, fraud, workplace misconduct, and litigation.
• Identify, interpret, and correlate operating-system artifacts, file activity, external storage usage, cloud synchronization, browser activity, email activity, application usage, and other relevant evidence.
• Develop defensible timelines based on multiple forensic data sources.
• Determine the meaning, reliability, and limitations of forensic artifacts.
• Maintain complete case notes, examination records, chain-of-custody documentation, and supporting exhibits.
• Prepare clear, accurate, and technically defensible forensic reports.
• Explain technical findings in plain language to attorneys, executives, clients, and other nontechnical audiences.
• Participate in client meetings, attorney conferences, findings presentations, and case-strategy discussions.
• Support the preparation of declarations, affidavits, deposition testimony, hearing testimony, and expert reports when required.
• Preserve the distinction between established facts, reasonable interpretations, and matters that cannot be determined from the available evidence.
• Review the work of junior personnel or evidence technicians as the forensic team expands.
• Assist with quality-control reviews of reports, exhibits, timelines, and forensic conclusions.
• Help develop and improve forensic procedures, examination workflows, reporting templates, and quality standards.
• Identify opportunities for responsible automation and more efficient evidence processing.
• Maintain awareness of changes in operating systems, applications, cloud platforms, forensic artifacts, and industry practices.
• Protect confidential, privileged, personally identifiable, and legally sensitive information.
• Meet case deadlines and communicate promptly when scope, evidence volume, or technical conditions may affect delivery.
• Travel periodically for evidence collection, client meetings, depositions, hearings, or other case requirements.

Requirements

At least five years of professional experience conducting digital forensic examinations or closely related investigations.

• Demonstrated ability to manage forensic matters independently with limited supervision.
• Strong knowledge of Windows forensic artifacts and file-system analysis.
• Experience examining computers, storage media, email, cloud data, and user activity.
• Experience investigating at least several of the following:
• Insider threats
• Employee data theft
• Trade-secret or intellectual-property theft
• Unauthorized access
• External storage and USB activity
• Cloud-storage and file-synchronization activity
• Email-related activity
• File deletion or attempted concealment
• Workplace misconduct
• Civil litigation or employment disputes
• Strong understanding of forensic acquisition, evidence preservation, hashing, documentation, and chain-of-custody requirements.
• Demonstrated ability to correlate evidence from multiple sources and build defensible activity timelines.
• Strong analytical judgment and careful attention to detail.
• Excellent written communication skills, including experience preparing formal forensic reports.
• Ability to explain technical findings clearly to nontechnical audiences.
• Experience communicating directly with attorneys, executives, clients, or other senior stakeholders.
• Ability to manage multiple investigations, priorities, and deadlines.
• Willingness to travel when case requirements make travel necessary.
• Ability to pass applicable background screening and comply with confidentiality and evidence-handling requirements.
• Legal authorization to work in the United States.

Preferred Qualifications

• Bachelor’s or master’s degree in digital forensics, cybersecurity, computer science, information technology, criminal justice, or a related discipline.
• One or more recognized forensic certifications, such as:
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Certified Forensic Analyst (GCFA)
• Certified Forensic Computer Examiner (CFCE)
• EnCase Certified Examiner (EnCE)
• Certified Computer Examiner (CCE)
• Cellebrite Certified Mobile Examiner (CCME)
• Other comparable digital forensic credentials
• Experience working for a digital forensics consultancy, incident response firm, law-enforcement laboratory, corporate investigations team, or litigation-support organization.
• Experience preparing expert reports, declarations, or affidavits.
• Prior deposition, hearing, or trial-testimony experience.
• Experience supporting attorneys in employment, trade-secret, intellectual-property, fraud, or other civil disputes.
• Experience with mobile-device forensics.
• Experience with Microsoft 365, Google Workspace, cloud storage, collaboration platforms, or cloud audit records.
• Experience with forensic scripting, data processing, automation, or custom investigative workflows.
• Experience mentoring junior examiners or reviewing the work of other forensic professionals.

Professional Qualities

• Careful and methodical without allowing avoidable delays to affect the investigation.
• Dependable in meeting deadlines and communicating case status.
• Comfortable making independent technical decisions while recognizing when consultation is appropriate.
• Precise in documentation, reporting, and evidence handling.
• Capable of defending their methods and conclusions under professional or legal scrutiny.
• Respectful of the limits of the available evidence.
• Comfortable working in a growing firm where processes continue to be refined.
• Interested in helping develop a high-quality forensic practice rather than only completing assigned technical tasks.
• Professional and composed when communicating with attorneys, executives, opposing experts, and clients facing stressful situations.

Measures of Success

• Independently progressing assigned forensic matters.
• Producing accurate and defensible work with limited substantive revision.
• Meeting agreed-upon deadlines and communicating risks early.
• Maintaining complete case documentation and evidence records.
• Providing clients and counsel with clear, useful explanations of forensic findings.
• Exercising sound judgment concerning forensic conclusions and evidentiary limitations.
• Contributing practical improvements to Cyber Centaurs’ examination, reporting, and quality-control processes.
• Developing the credibility and case experience necessary to support expert-witness engagements where appropriate.

Work Arrangement and Travel

This position may be performed remotely within the United States. Periodic travel to Cyber Centaurs’ Orlando office, client locations, evidence-collection sites, depositions, hearings, or trials may be required.

Some investigations may require schedule flexibility due to court deadlines, urgent preservation needs, travel, or time-sensitive client matters.

Benefits

Professional Growth and Leadership

• Work directly with the Managing Principal and experienced forensic investigators.

• Help shape the procedures, quality standards, and future direction of a growing digital forensics practice.

• Develop toward broader technical leadership and potential responsibility for the forensic practice.

Meaningful Investigative Work

• Conduct substantive corporate, legal, and litigation-related investigations.

• Work on matters involving insider threats, employee data theft, trade-secret theft, unauthorized access, fraud, and workplace misconduct.

• Take ownership of investigations from evidence acquisition through analysis, reporting, and presentation of findings.

Litigation and Expert Engagements

• Support attorneys and clients in complex litigation, employment, trade-secret, intellectual-property, and other contested matters.

• Prepare clear and defensible forensic reports, declarations, affidavits, timelines, and supporting exhibits.

• Participate in attorney conferences, depositions, hearings, trials, and other expert engagements when required.

• Apply existing testimony experience while continuing to expand professional credibility across complex forensic matters.

Culture

• Join a small, focused, and high-performance team.

• Work in an environment that values precision, accountability, sound judgment, and defensible conclusions.

• Contribute directly to improving investigative workflows, forensic capabilities, and client outcomes.

Benefits

• Flexible paid time off

• Medical insurance

• Paid holidays

• Sick leave

• Annual professional-development allowance

• Company-provided computer equipment, business mobile phone, software, and forensic tools

• Eligibility for applicable performance bonus and growth incentive programs

Benefits and eligibility are governed by applicable plan documents and company policies.