Senior Digital Forensics Examiner - ITS5

Senior Digital Forensics Examiner - ITS5 Working Title: Senior Digital Forensics Examiner Job Class: Information Technology Specialist 5 Agency: Minnesota IT Services Job ID : 94402 Location : St. Paul Full/Part Time : Full-Time Regular/Temporary : Unlimited Who May Apply : Open to all qualified job seekers Date Posted : 05/27/2026 Closing Date : 06/09/2026 Hiring Agency/Seniority Unit : Minnesota IT Services Work Shift/Work Hours : Day Shift Days of Work : Monday - Friday Travel Required : No Salary Range: $39.73 - $67.92 / hourly; $82,956 - $141,816 / annually Job Class Option : Information Security Classified Status : Classified Bargaining Unit/Union : 214 - MN Assoc of Professional Empl/MAPE The work you'll do is more than just a job. At the State of Minnesota, employees play a critical role in developing policies, providing essential services, and working to improve the well‑being and quality of life for all Minnesotans. The State of Minnesota is committed to equity and inclusion, and invests in employees by providing benefits, support resources, and training and development opportunities. Join the 2,800+ professionals of Minnesota IT Services (MNIT) who connect Minnesotans to services that will improve their lives. This position will be part of the Enterprise Security team, which embeds security protection statewide. Job Summary The Senior Digital Forensics Examiner (SDFE) assumes an advanced technical role within the MNIT Digital Forensics Laboratory (MDFL) to provide the State of Minnesota with digital forensics services based on established Enterprise policies, programs, laws, and regulations. The SDFE conducts digital forensics investigations for internal investigations and security investigations. The SDFE is responsible for scoping, data acquisition, processing, advanced analysis, and reporting on the most complex and sensitive cases handled by the MNIT Digital Forensics Laboratory. This position may assist other government entities with investigations as well as consult with them on digital forensics and investigative matters. This position uses tools and investigative techniques to assess, acquire, analyze, document, and report on digital forensic artifacts, system‑level details, metadata, and other investigative material associated with internal and security investigations. The incumbent conducts laboratory maintenance, develops laboratory procedures and processes, and performs research and testing on new technologies. The SDFE plays an integral role in mentoring and assisting other staff within the MNIT Digital Forensics Laboratory (MDFL). You will be part of an forensics team that engages in a wide variety of important work. You will play a key role within the MNIT Digital Forensics Laboratory (MDFL) and assist with improving services, automation, implementing new technologies, developing documentation, and building key relationships with customers while continuing to expand your digital forensics and investigative knowledge. This position requires onsite work at the MNIT Digital Forensics Laboratory (MDFL) located in St. Paul, MN; remote work may be available in accordance with State policy and laboratory operational needs. Responsibilities Perform advanced digital forensics services for executive branch agencies to acquire, document, and report on digital forensic artifacts, system‑level details, metadata, and other investigative material associated with internal investigations, security investigations, and other investigative requests. Provide digital forensic consultation and perform digital forensic services for State agencies and, as appropriate, limited third‑party engagements, including evidence identification, forensic collection considerations, investigative approach, forensic tools and methodologies, and documentation related to digital forensic examinations. Manage digital forensics examinations through the entire lifecycle, including case planning, intake, acquisition, processing, examination, reporting and presentation, and testimony. Provide technical recommendations for developing enterprise‑wide forensic standards and practices. Develop and document laboratory processes and procedures and provide training to laboratory staff as appropriate. Act as an expert witness on digital forensic examinations, including interpreting and presenting forensic findings and reports in legal proceedings. Assist other laboratory staff in deposition and testimony preparation and work with legal counsel as needed. Maintain the MNIT Digital Forensics Laboratory, including performing validations, developing forensic processes and procedures, and troubleshooting and resolving technical issues. Mentor other laboratory staff and serve as a team lead within the MNIT Digital Forensics Laboratory. Provide training and advice on forensic‑related matters to a wide variety of audiences, including MNIT staff, agency legal teams, agency Human Resources teams, vendors, and other government partners. Partner with security teams as needed on security investigations to help determine investigative scope and impact. Research and stay abreast of new digital forensic methods, tools, processes, and best practices. Play a key role in advanced research and testing and develop standards for conducting research and testing. Understand MNIT Digital Forensics Laboratory policies, procedures, and processes and act as a subject matter expert in this area for other laboratory staff. This position requires an employee to be onsite at 600 Cedar Street, St. Paul, Minnesota at least 50% of the time, with some opportunity to perform work from a telework location. Telework for Minnesota IT Services is available on a limited basis. Employees will be required to meet current telework eligibility requirements. Qualifications Minimum Qualifications To qualify, candidates must clearly show all of the following qualifications in their resume. Position requires a minimum of five (5) years of IT related experience in digital forensics, role that includes experience supporting investigative work (e.g., internal, corporate, or criminal investigations). Experience must include: Knowledge of digital forensics methodologies, industry standards, and best practices. Experience performing live system forensics, dead‑box forensics, mobile forensics, and/or network forensics and conducting investigations, including scoping, data acquisition, data processing, forensic analysis, and reporting. Working knowledge and experience with computer hardware and the ability to work with a wide variety of hardware types, including desktops, laptops, tablets, smartphones, and Internet‑of‑Things (IoT) devices. Knowledge of general IT concepts and technologies such as databases, networking, scripting, system administration, application and system design, backup technologies, email systems, cloud services, and IoT devices. Experience with multiple operating systems (e.g., Windows, Linux, macOS) and multiple file systems (e.g., NTFS, EXT3/4, HFS, Android) as they relate to forensic investigations. Demonstrated ability to communicate clearly and effectively in a manner that facilitates mutual understanding. Customer‑focused approach grounded in active listening, empathy, and solution‑oriented problem‑solving to deliver positive user experiences. Education in Information Technology (IT) or an IT related field may substitute for experience as follows: a master’s degree for eighteen (18) months of experience; a bachelor’s degree for one (1) year; and an associate’s degree for six (6) months. Preferred Qualifications Experience with digital forensic tools such as Magnet Axiom, EnCase, Volatility, Cellebrite UFED / Physical Analyzer / Inseyets, Cellebrite Digital Collector, WinHex Specialist, Forensic Explorer, or similar forensic tools, as well as experience with Microsoft cloud environments, including Microsoft Purview, Azure, Entra ID, and Microsoft 365 services, with an understanding of how these platforms store, manage, and expose data relevant to digital forensic investigations and data acquisition. Experience with specialized digital forensic domains, including network forensics (e.g., log analysis and data correlation), mobile device forensics, and Internet‑of‑Things (IoT) investigations involving the identification, acquisition, and analysis of data. Experience with case management systems, evidence management systems, quality control processes and systems used to support digital forensic investigations and laboratory operations. Ability to lead, collaborate within a team environment, and adapt to evolving investigative priorities, with high attention to detail, strong analytical skills, high ethical standards and professionalism, and excellent written and verbal communication skill. Strongly Preferred Qualifications Certifications such as CFCE (IACIS), CCE, ENCE, GCFA, GNFA, Cellebrite certifications, or other relevant digital forensic certifications; foundational or advanced security certifications (e.g., CompTIA A+, Network+, Security+, CISSP) are also considered beneficial. Experience working in a structured digital forensics laboratory environment, including laboratory maintenance, validations, adherence to established policies, procedures, and standards, and participation in quality control processes (e.g., peer and technical review) to ensure defensible and repeatable forensic practices; familiarity with ANAB accreditation or similar frameworks is beneficial. Experience supporting internal, corporate, security or criminal investigations, and having the ability to compose clear, concise, and comprehensive technical documentation and digital forensic investigative reports tailored to a variety of audiences, and experience supporting or providing testimony in legal proceedings (e.g., depositions, hearings, or trials) in addition to working with subpoenas, warrants, or other legal processes. Additional Requirements It is the policy of Minnesota IT Services that a successful candidate must pass all legally required checks prior to employment which may consist of the following: SEMA4 Records Check (applies to current and past state employees only) Criminal History Check Reference Check Social Security and Address Verification CJIS Background Check Other legally required checks Minnesota IT Services does not participate in the federal E‑Verify program. Minnesota IT Services is unable to sponsor applicants for work visas, including F‑1 STEM OPT extensions, and cannot complete Form I‑9 or any other documentation requiring employer participation in E‑Verify. All applicants must be legally authorized to work in the United States at the time of application. Veterans To be considered for any Veteran's Status , you MUST indicate this on your application. RECENTLY SEPARATED VETERANS (RSV) : Effective July 1, 2009, legislation provides that the top five RSV applicants who apply and meet the qualifications for a vacancy shall be granted an interview. You must: Meet all Minimum Qualifications identified in this posting. CERTAIN DISABLED VETERANS: Effective August 1, 2012, legislation provides state agencies with the option to appoint certain disabled veterans on a noncompetitive basis if you: Meet service requirements and have a verified service‑connected disability rating of at least 30%. Provide qualifying documentation verifying the disability. Meet all Minimum Qualifications identified in this posting. Current employees of Minnesota IT Services who are currently in a Information Technology Specialist 5/Information Security position and who are eligible to bid and apply within the seven (7) day bidding period will be considered prior to filling the position via other means. Current State Employees: Please note that employment provisions (including but not limited to seniority and leave accrual) vary among the three branches of Minnesota State government. When considering a job with another branch of state government, you are highly encouraged to explore these differences. For assistance, please direct questions to your current or anticipated Human Resources office. About Minnesota IT Services Minnesota IT Services is the information technology agency for the State of Minnesota. MNIT partners with agencies, boards, councils, and commissions to deliver secure, reliable technology solutions as we set IT strategy, direction, policies, and standards statewide. Work for MNIT and be part of a nation‑leading IT organization that helps to create an innovative government that works for everyone. Our culture promotes collaboration, demands agility, and encourages us to embrace change. Be a part of something bigger than yourself, something to be inspired by; come to work for MNIT . Working together to improve the state we love. What do Minnesota's State employees have in common? A sense of purpose in their work Connection with their coworkers and communities Opportunities for personal and professional growth As an employee, you'll have access to one of the most affordable health insurance plans in Minnesota, along with other benefits to help you and your family be well. Your benefits may include: Paid vacation and sick leave 12 paid holidays each year Low‑cost medical, dental, vision, and prescription drug plans Fertility care, including IVF Diabetes care Dental and orthodontic care for adults and children 6 weeks paid leave for parents of newborn or newly adopted children Pension plan that provides income when you retire (after working at least three years) Employer paid life insurance to provide support for your family in the event of death Short‑term and long‑term disability insurance that can provide income if you are unable to work due to illness or injury Tax‑free expense accounts for health, dental, and dependent care Resources that provide support and promote physical, emotional, social, and financial well‑being Support to help you reach your career goals: Training, classes, and professional development Federal Public Service Loan Forgiveness Program (Some positions may qualify for the Public Service Loan Forgiveness Program. For more information, visit the Federal Student Aid website at studentaid.gov ) Employee Assistance Program (EAP) for work/life support: A voluntary confidential program that helps employees and their families with life challenges that may impact overall health, personal well‑being, or job performance Common sources of stress can be addressed through the EAP: mental health, relationship challenges (personal and work), grief and loss, finances, and legal issues Daily Living/Convenience Services: Chore services, home repair, trip planning, child/elder care Programs, resources and benefits eligibility varies based on type of employment, agency, funding availability, union/collective bargaining agreement, location, and length of service with the State of Minnesota. EQUAL OPPORTUNITY EMPLOYERS Minnesota state agencies are equal opportunity, affirmative action, and veteran‑friendly employers. State agencies are committed to creating a workforce that reflects the diversity of the state and strongly encourages persons of color and Indigenous communities, members of the LGBTQIA2S+ community, individuals with disabilities, women, and veterans to apply. The varied experiences and perspectives of employees strengthen the work we do together and our ability to best serve Minnesotans. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, national origin, sex (including pregnancy, childbirth, and disabilities related to pregnancy or childbirth), gender identity, gender expression, marital status, familial status, age, sexual orientation, status regarding public assistance, disability, veteran status or activity in a local Human Rights Commission or any other characteristic protected by law. APPLICANTS WITH DISABILITIES Minnesota state agencies make reasonable accommodations to their employees and applicants with disabilities. If you have a disability and need assistance in searching or applying for jobs with the State of Minnesota, call the Careers Help Desk at View phone number on click.appcast.io or email View email address on click.appcast.io and let us know the support you need. #J-18808-Ljbffr