Digital Media Exploitation Examiner

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

Peraton is seeking a Senior Digital Media Exploitation Examiner in our Linthicum, MD office in support of our Department of Defense (DoD) customer as part of a highly talented, highly motivated, and high-performing team. This position offers a unique opportunity to work at the forefront of cyber investigations, digital forensics, cyber threat analysis, and mission support in a dynamic and collaborative environment. The successful candidate will contribute to protecting national security interests by leveraging technical expertise, analytical skills, and innovative problem-solving to address complex cyber challenges. Individuals who are passionate about cybersecurity, committed to excellence, and eager to make a meaningful impact are encouraged to apply.

 

The ideal candidate will conduct comprehensive exploitation and/or forensic examinations on a diverse range of digital media, including hard drives, mobile devices, and removable media. You will serve as a subject matter expert, responsible for the entire lifecycle of digital exploitation from acquisition to reporting. This role requires a meticulous and analytical mindset, and target-centric approach, coupled with the ability to convey complex technical findings to both technical and non-technical audiences.

Core Responsibilities

• →Conduct forensically sound examinations of digital and mobile devices (including computers, smartphones, and tablets) to support targeting, intelligence reporting, and network development in response to operational mission partner requirements.
• →Utilize industry-standard forensic tools and advanced techniques to perform data extraction, recovery, and in-depth analysis of file systems, operating systems (Windows, macOS, Linux, iOS, Android), and application data.
• →Perform comprehensive analysis / targeting, including timeline generation, file signature and hash analysis, email and communication analysis, and examination of large, complex datasets.
• →Identify and analyze malware and evidence of intrusion or unauthorized activity.
• →Prepare detailed, clear, and concise technical reports documenting examination procedures, findings, and expert opinions for a variety of audiences, both technical and non-technical.
• →Perform peer reviews of exploitation reports to ensure technical accuracy, completeness, and adherence to established standards.
• →Maintain strict chain of custody for all digital evidence and associated documentation.
• →Provide expert consultation to stakeholders on Tactics, Techniques, and Procedures (TTPs) for targeting, network development, reporting, digital evidence handling and forensic examinations.
• →Stay abreast of the latest developments in digital exploitation technology, trends, and methodologies to ensure the use of current best practices.

Required Skills & Experience

• Proven proficiency with industry-standard forensic tool suites (e.g., EnCase, FTK, Magnet AXIOM, X-Ways Forensics, Autopsy).
• Demonstrated mobile exploitation experience extracting and parsing iOS and Android devices using tools such as Cellebrite UFED/Physical Analyzer or GrayKey.
• Working knowledge of file systems and structures (NTFS, FAT32, exFAT, EXT3/4, APFS, HFS+).
• Demonstrated ability to identify full-disk, volume, and file-level encryption and evaluate appropriate key extraction or decryption workflows.
• In-depth knowledge of cryptographic hashing algorithms (MD5, SHA-1, SHA-256) and their practical forensic application for data integrity verification and identifying known threat artifacts.
• Experience conducting static and behavioral triage of malicious files (e.g., string analysis, header analysis, sandbox execution) to support forensic attribution.
• Strong technical writing and briefing capabilities, with experience authoring formal forensic reports.
• Must possess an active Top Secret/SCI security clearance with a Polygraph.
• Current DoD 8570/8140 IAT Level II certification (e.g., CompTIA Security+, CySA+, GICSP).
• Bachelor's degree and 8+ years relevant experience, or Master's degree and 6+ years relevant experience. However, an additional 4 years of relevant experience or specialized training may be considered in lieu of Bachelor's degree.

Preferred Skills & Experience

• Advanced industry certifications, such as:
  • GIAC Certified Forensic Examiner (GCFE) or Analyst (GCFA)
  • GIAC Advanced Smartphone Forensics (GASF)
  • Cellebrite Certified Mobile Examiner (CCME)
  • EnCase Certified Examiner (EnCE)
  • AccessData Certified Examiner (ACE)
  • Certified Forensic Computer Examiner (CFCE)
• Proficiency in programming or scripting languages (e.g., Python, PowerShell) to automate exploitation workflows, parse novel artifacts, and process bulk data.
• Prior experience working within the Intelligence Community (IC) and / or support to operational mission partners.
• Prior deployed experience conducting exploitation in support of operational mission partners in both lab and field environments.
• Knowledge of and / or prior offensive cyber, offensive supply chain, penetration testing, or targeting experience / familiarity.
• Demonstrated experience authoring finished intelligence reports and assessments.

$135,000 - $216,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity. Use of artificial intelligence (AI) tools of any kind during Peraton interviews is strictly prohibited unless the candidate has obtained prior written authorization. All interview responses must be the candidate’s own.

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.