Senior​/Manager​/Assistant Manager, Digital Forensics Branch

[What the role is]

Digital forensics plays an important role in generating leads for investigators to track down criminals and uncover digital evidence to support the prosecution of these criminals.

The officer will be part of the Digital Forensics team in the Technology Investigation Support Division (TISD) that performs digital forensics investigations such as data acquisition, evidence recovery and forensics examination of digital devices in support of investigation and prosecution. Additional responsibilities may also include assisting in managing the forensics laboratory and its supporting infrastructure as well as to identify new technologies to enhance forensics analysis.

• Conduct thorough digital forensics seizures, preservation and examination of digital evidence from devices, operating systems and/or networks and ensure all forensic processes comply with legal, procedural, and evidentiary standards.
• Properly identify, collect, label, document, store, and manage digital evidence in accordance with established procedures. Maintain complete chain-of-custody records.
• Document detailed findings. Provide objective assessment of digital evidence and to recommend appropriate opinion on assessment of evidence to stakeholders.
• Create comprehensive, court-ready forensic reports and provide expert testimony in court to support investigative teams in evidence presentation.
• Work closely with investigating officers, legal officers to scope forensic requirements and assist in identifying investigative leads based on digital evidence.

• Manage and maintain forensic laboratory tools, systems, licenses, and inventories.
• Develop, review and maintain SOPs and investigative processes; recommend and implement process improvements. Support digital evidence handling policies, chain-of-custody protocols and accreditation requirements.

• Keep skills current through training, certification and professional development. Identify training needs and support knowledge transfer within the unit.
• Contribute to knowledge-sharing, mentoring and training of staff and stakeholders, where appropriate.
• Monitor developments and identify new trends, stay up-to-date with evolving digital technologies, emerging threats, forensic methods, and legal precedents.
• Assess implications of new technologies on forensic readiness and investigation approaches.

• Establish and maintain a network of liaison contacts with other law enforcement agencies to exchange information, best practices, experience and expertise, etc.
• Collaborate and co-ordinate with other agencies in joint enforcement and investigations, etc.

• A background referably in Digital Forensics, Information Technology, Cybersecurity, Computer Science or any other relevant discipline.
• Minimum of 2–5 years of professional experience in digital forensics, incident response, or cybersecurity.
• Proficiency with industry-standard forensic tools such as Cellebrite, Magnet AXIOM, Autopsy/Sleuth Kit, Oxygen Forensic Detective, EnCase, FTK, MSAB XRY etc.
• Ability to acquire and analyze data from Computers (Windows, macOS, Linux), mobile devices (iOS, Android), cloud environments, network storage, memory dumps, volatile data and IoT devices.
• Possession of a good understanding of forensic artefacts in operating systems, file systems, data recover technology and forensic investigation procedures.
• Proficient in scripting and automation (e.g., Python, Power Shell, Bash) to enhance forensic workflows.
• Demonstrated experience in lab management, forensic acquisition, analysis, and reporting of digital evidence.
• Possession of professional certifications or industry-recognised qualification related to Digital Forensics such as Cellebrite Certified Physical Analyst (CCPA), Magnet Certified Forensic Examiner (MCFE), EnCase Certified Examiner (EnCE), GIAC Advance Smartphone Forensics (GASF), GIAC Certified Battlefield Forensics and Acquisition (GBFA), GIAC Certified Forensic Examiner (GCFE) or GIAC…