Computer Forensic Investigator
APPOINTMENT TYPE: Permanent-Exempt (PEX) Appointment. This position is excluded by the Charter from the competitive civil service examination process and shall serve at the discretion of the appointing officer.
The Office of the City Attorney serves as the legal counsel for the City and County of San Francisco. The Office plays a critical role in the resolution of the legal and social issues facing San Francisco. In addition to generally advising and defending the City, the Office actively pursues legal remedies to challenges impacting the safety, welfare, and quality of life of all San Franciscans.
POSITION DESCRIPTION:
Under general supervision, the Computer Forensic Investigator conducts digital forensic investigations for cases of importance to the administration of local government, including but not limited to cases involving employee misconduct, unscrupulous business practices, and ethics violations. Responsibilities include the forensic analysis of hard-drives, laptops, cellular phones, network drives, other digital storage devices, and social media using various forensic software tools, including EnCase or FTK; Cellebrite; and Magnet AXIOM. In addition, the Computer Forensic Investigator prepares detailed reports of interviews and forensic investigations; collaborates with attorneys during the investigative process; confers with attorneys in connection with trial preparation for cases involving litigation; and makes court appearances and provides testimony relating to such cases as required. The Computer Forensic Investigator also may support investigations using other database tools such as Ipro and Concordance.
MINIMUM QUALIFICATIONS
Education:
1. Certification as a computer investigative specialist or examiner, and
2. Possession of a baccalaureate degree from an accredited college or university
3. Possession of a valid Class C Driver’s License; and
Experience:
Four years experience performing investigations, litigation support, or IS administrative support.
Substitution of Education: Experience in involving analytical report writing may be substituted for the required degree on a year-for year basis (up to a maximum of four (4) years). One (1) year is equivalent to thirty (30) semester units OR forty-five (45) quarter units.
DESIRED QUALIFICATIONS
· Three (3) years of professional experience collecting and analyzing digital evidence in a legal or law enforcement environment
· Experience coordinating with IT professionals from other entities to facilitate the transfer of data for forensic review
· Strong research, analysis, and writing skills
· Strong interpersonal and communication skills
· Significant knowledge of commonly used operating systems and database applications
· Experience testifying as a qualified expert in digital forensic examination
· Ability to explain computer forensic processes to lay people
· Ability to work independently and collaboratively in a fast-paced law office environment with rapidly changing work assignments and priorities
· Experience or aptitude with litigation support applications such as Ipro and Concordance
· Ability to create summaries of evidence and demonstrative exhibits for use at trial