Digital Forensics Specialist

Agency Safety Division 70000075 Dept of Public Safety Job Classification Title IT Security & Compliance Specialist II (NS) Position Number 60066501 Grade DT10 About Us The Department of Public Safety's mission is to safeguard and preserve the lives and property of the people of North Carolina through preparation, prevention, and protection with integrity and honor. Our agency houses many public safety divisions, including Emergency Management, Juvenile Justice and Delinquency Prevention, Alcohol Law Enforcement, Samarcand Training Academy, and the North Carolina National Guard. Join us along with our more than 3,000 employees and 12,000 National Guard members in providing exceptional public safety services to the citizens of North Carolina. Description of Work About NCEM: The mission of North Carolina Emergency Management (NCEM) is to enhance North Carolina's resiliency through active collaboration, communication, and coordination of efficient and effective preparedness, response, recovery, and mitigation of all natural and manmade hazards and threats. It is part of the NC Department of Public Safety (NCDPS). About the Homeland Security Section: The mission of the Homeland Security Section is to provide the Division and the State Emergency Response Team (SERT) with proactive critical infrastructure planning and protection support, situational awareness and intelligence gathering, interagency coordination, and cyber preparedness, mitigation and response in collaboration with local, state, and federal partners. This collaboration includes training and assistance; strategic planning; investigative and intelligence support. The Homeland Security Section also collaborates with local, state and federal partners supporting the education sector in North Carolina. About the Position: The Digital Forensics Specialist is responsible for assessing specific, potential incidents related to investigations and events, provides specialized technical case and operational support, and produces highly-technical strategic intelligence. Technical analysis provides a detailed picture of events as they occurred and allows an intelligence analyst to connect these events to cyber actors, tools, and tactics, techniques, and procedures (TTPs) inside and outside of the jurisdiction. This Specialist will primarily focus on highly-technical matters and will require multiple certifications and/or extensive cyber training and experience. This position will perform analysis of raw, primary, and secondary data derived from various sources; including assisting with log analysis, netflow analysis, incident response, malware analysis, computer forensics, and penetration testing services; work alongside Department of Defense, federal, state, and local agencies in addressing threats posed by terrorists, nation-states, and other cybercriminals conducting cyber-attacks; assist with cyber security and provide actionable recommendations regarding the cyber security of partners on local, state, federal, and Department of Defense networks and hunt for indicators of compromise, using various toolsets, based on intelligence gathered. This position will serve on cyber working groups and Incident Response Teams, as appropriate; monitor a variety of classified, sensitive, partner, and open source reporting for cyber information relevant to partners and/or the Fusion Center domain; coordinate with appropriate personnel, organizations, and units, including but not limited to the Department of Public Safety, the Department of Information Technology, state and federal membership of the Homeland Security Advisor Work Group, state and local law enforcement, and the owners and operators of Critical Infrastructure (CI), the Multi-State Information Sharing and Analysis Center (MS-ISAC) and other Information Sharing and Analysis Organizations (ISAOs). This position will produce daily, monthly, and/or ad-hoc, actionable intelligence products on emerging cyber incidents, risks, threats, events, or trends; provide actionable strategic and technical intelligence to partners regarding new cyber trends and patterns, TTPs, tools, or actors related to state and Department of Defense networks. The position will work with other Fusion Center staff to ensure that developments in cyber, computer, and network security, and law enforcement investigative capabilities are accounted for in non-cyber focused intelligence production; and take an active part in the gathering, analysis, and communication of threat intelligence through the designated process. Knowledge Skills and Abilities/Management Preferences Recruitment Range: 87,617 - 131,426 This is a full-time position (40 hours per week) with State Benefits, including paid vacation, paid sick leave, paid holidays, retirement, and health insurance. To view an example of total compensation, please click here NC OSHR: Total Compensation Calculator. We value our employees and are committed to providing flexibility in work schedules. This position qualifies for teleworking on a part-time basis as part of the State Telework Program. DPS uses the Merit-Based Recruitment and Selection Plan to fill positions subject to the State Human Resources Act with the most qualified individuals. The Minimum Education and Experience (E&E) is REQUIRED to qualify for this position. Management Preferences, including Knowledge, Skills, and Abilities (KSAs), are not required but may be used to determine the pool of most qualified applicants. Managers may also choose to interview/select applicants who demonstrate Management Preferences. All work history and education (including accurate dates of employment/attendance) must be documented on the application. Work experience may include internships, volunteerism, and full and part-time work. A complete, all-inclusive application maximizes an applicant's potential to qualify for the position, as well as receive the highest possible salary if selected for the position. Salary will be based on relevant qualifications, internal equity, and budgetary considerations for the advertised position. Click here for more information and application resources. Resumes may be attached as a supplement to the application but are not a substitute for a complete application. Management Preferences: • Be able to attain and maintain a DHS sponsored security clearance. • Knowledge of incident response and handling methodologies. • Knowledge of cyber defense mitigation techniques and vulnerability assessment tools, including open-source tools, and their capabilities. • Knowledge of security intelligence threats and threat actors • Basic knowledge of various computer and digital forensic methodologies and related tools to extract actionable intelligence. Supplemental and Contact Information The North Carolina Department of Public Safety (DPS) is an Equal Opportunity Employer who embraces an Employment First philosophy which consists of complying with all federal laws, state laws and Executive Orders. Consistent with the Americans with Disabilities Act (ADA), we are committed to full inclusion of qualified applicants and will review requests for reasonable accommodation to perform essential job functions during the hiring process or while on the job. Public Service Loan Forgiveness Program For applicants with student loans, becoming a state employee may include eligibility for the Public Service Loan Forgiveness Program. Visit www.studentaid.gov to learn more. Transcripts • Attaching transcripts is optional; however, we recommend applicants attach unofficial transcripts to assist in providing credit for education including in substituting education gained for experience. Additionally, qualifying for some positions may require validating hours of coursework in a specific field of study and transcripts are crucial to awarding credit. Degrees and transcripts must be achieved from an appropriately accredited college or university. • Applicants who earned college credit hours but did not complete a degree program must attach an unofficial transcript to receive credit for education. • International degrees and transcripts must be evaluated for accreditation by a recognized evaluation service by the closing date of this posting. Failure to provide documentation may result in ineligibility. The National Association of Credential Evaluation Services (NACES) has several options to provide credential verification: https://www.naces.org/members. Military Experience • Applicants seeking Veteran's Preference must attach a DD-214 Form (Certificate of Release or Discharge from Active Duty that includes Character of Discharge - Member 4 or Service 2 form) to the application. • Applicants seeking National Guard Preference: o A current member of the North Carolina National Guard in good standing must attach a NGB 23A (RPAS). o A former member of the North Carolina National Guard who served for at least 6 years and was discharged under honorable conditions must attach either a DD256 or NGB 22. The NC Dept. of Public Safety must adhere to the US Dept. of Justice Final Rule on the "National Standards to Prevent, Detect, and Respond to Prison Rape." PREA Hiring and Promotion Prohibitions. Selected applicants for positions which are subject to PREA will undergo a PREA-specific background check. Our agency supports second-chance employment for individuals who were previously incarcerated, or justice involved, and we invite all potential applicants to apply for positions for which they may be qualified. Due to the nature of work performed in our agency, prior convictions and/or charges may prohibit employment for positions which are subject to PREA or other position-specific background checks. Due to the volume of applications received, we are unable to provide information regarding the status of your application. Please log in to your Workday account to check the status of your application. If you are selected for an interview, you will be contacted by the hiring manager. If you are no longer under consideration, you will receive an email notification when the position is filled. For more information about the application process, please visit State Application Resources/Frequently Asked Questions. For technical issues related to your Workday applications, please place a support ticket. For basic information regarding employment with North Carolina State Government, please call (984) 236-0800. If there are any questions about this specific vacancy other than your application status, please contact Ashley Minnick at [email protected]. Minimum Education and Experience Some state job postings say you can qualify by an "equivalent combination of education and experience." If that language appears below, then you may qualify through EITHER years of education OR years of directly related experience, OR a combination of both. See the Education and Experience Equivalency Guide for details. Bachelor's degree in computer science or a related IT field or closely related field from an appropriately accredited institution and two years of progressive experience in IT Security or closely related area; or Associate degree in computer science or a related IT field or closely related field from an appropriately accredited institution and three years of progressive experience in IT security or closely related area; or an equivalent combination of education and experience. EEO Statement The State of North Carolina is an Equal Employment Opportunity Employer and dedicated to providing employees with a work environment free from all forms of unlawful employment discrimination, harassment, or retaliation. The state provides reasonable accommodation to employees and applicants with disabilities; known limitations related to pregnancy, childbirth, or related medical conditions; and for religious beliefs, observances, and practices. Recruiter: Ashley Simone Minnick Recruiter Email: [email protected]