Since the start of the year, I had been acutely aware that my Forensic IT MSc was rapidly approaching its conclusion. Conversations with course colleagues on job opportunities followed similar themes; nervousness about the tenuous state of the market and the difficulty of breaking into a relatively narrow field with very limited job vacancies. Company names with possible vacancies were traded like currency; conventions, conferences and free of charge lectures dutifully attended with crisp curriculum vitaes ready to thrust into reluctant vendors’ hands. Against this backdrop were the familiar stories of redundancy, unemployment and withdrawal of graduate recruitment schemes. My previous employer’s parting words from the summer suggesting that it was foolhardy to consider a change of job, let alone career in the current climate rung in my ears. Fortunately, coursework deadlines, end of year exams, and the dissertation meant that dwelling on the job situation was not an option; save for the occasional well intentioned letter from companies stating that they would keep my name on file but were not currently recruiting it was easy to forget about the pressing need for employment. This was the first mistake that I made, and probably the most common one amongst those of us coming to the end of a course of education: waiting until the course has finished or nearly finished to start the job hunt in earnest. However, we all know why this happens and it is not usually laziness or lack of forward planning; the workload in these courses is nearly always intense in the last few months.

It was around this time that I had something of a lucky break. An acquaintance who runs a small law practice contacted me on behalf of his client. The client had suffered a fairly serious personnel and IP theft problem and was in need of forensic computing assistance. Their business was in dire straits and was struggling to find the finances to keep afloat, let alone pay some of the consultancy rates which they had been quoted. My name was put forward and I met with the client and helped out as far as I reasonably could, given my lack of hardware, software and digital forensics experience. The result for the client was a mixed one – I found some relevant evidence in a forensically sound manner but the legal implications of this was not as strong as hoped. It is fair to say that this baptism of fire into practical computer forensics was not particularly financially profitable and necessitated finding free time when this was at a premium. However, what it undoubtedly did was give me was a small but significant amount of experience.

Shortly afterwards, I e-mailed a specialist computer forensics recruiter in mid June on the back of a talk given at my University and attached a CV. As luck would have it, there was a suitable vacancy and I was given some details. My previous IT experience is predominantly systems support based, and my existing CV was strongly biased towards finding this kind of work. Some changes were clearly necessary and it was duly rewritten, redesigned and reworked until it looked up to scratch. Revisions of this all important document were bounced off several contacts that are or have been in the business of deciding whether to employ people. This exercise taught me that regardless of how complete you may believe your CV to be, peoples’ preferences and biases will always result in their flagging different things as being in need of work. It is easy to get caught up in obsessing over the minutiae of the document, and probably not that useful. Ultimately, the person reading your CV will look upon it with different eyes.

The finished article was submitted to the prospective employer on my behalf while I reminded myself not to get my hopes up; after all, I had distributed a few CVs by this point and rarely received so much as the courtesy of a reply. However, clearly the document had presented me well enough and a telephone interview was arranged. The telephone interview is not something of which I have much experience and there are clearly advantages to such a system. It is convenient and efficient for both parties; it allows the interviewer to quickly establish whether a candidate is of real interest, and it allows the candidate to get a feel for whether the job is right for them without wasting time and money travelling to the interview. And of course, it is the only time that it is appropriate to be interviewed in shorts and a t-shirt for a professional job. I was called on my mobile promptly at the arranged time, 11am, by the VP and a Senior Analyst in conference. Obviously, there were certain questions which they had prepared in order to gauge both my technical and professional abilities. For my part, I took the opportunity to have a few notes in front of me which I had prepared on the company and the job, mainly from their website, and some questions that I wanted to ask. It was at this point that I realised that the disadvantage to the telephone interview is the inability to read expressions and body language; I felt that I fluffed parts of the interview because I spoke out of turn, for example. I remembered somebody once telling me that standing whilst talking on the telephone can instil more confidence and I can attest to that. I also found it helpful to use my Bluetooth earpiece and have a glass of water handy. The conversation was quite long and ranged over a number of topics; my practical IT experience and recent investigation were discussed. The job seemed to be exactly what I was after and I genuinely felt that the description of the person that the interviewees were looking for matched my skill set and ways of working. However, afterwards I found it difficult to be particularly confident due to the inability to read any body language or facial expressions. One comment from the VP stuck in my mind, mentioning that I should read up on a piece of terminology for ‘future interviews’, but I obviously could not be certain if this was just a general suggestion as my answer to that particular question was weak.

I ploughed on with my project for several days, which turned into a week, and received a call from the recruiter. I was being called in for a face to face interview! Obviously, this is always great news but also increases the nerves tenfold. I re-read the company website and researched the terminology which was mentioned in the telephone interview. The interview was set for midday, giving me lots of time to get there. They say that you can never be too rich or too thin; to this I would add that you can never leave for an interview too early. My journey into central London should have taken a maximum of 90 minutes; sensibly, I left more than three hours to get there. An accident on the M1 caused the first delay. I diverted to the nearest railway station and hopped onto a fast train, nervously checking and re-checking my watch. Naturally, the train ground to an inexplicable, frustrating halt a few miles from the terminus. After what felt like hours, the carriages shuddered on and I leapt from the train and onto the first of two tubes, which promptly broke down. I dashed onto another, which was delayed due to the breakdown of the first tube. I am not superstitious by nature, but by this time I was honestly beginning to consider whether fate was trying to tell me something. I finally arrived at reception three and a half hours after leaving home, bedraggled and overheated, thirsty and not looking at all like a well prepared candidate. It almost goes without saying that I did not particularly fancy my chances at this stage.

Fortunately, my interviewers kept me waiting in reception just long enough to catch my breath. I was lead into a mercifully air conditioned meeting room. The two interviewers from the telephone interview filed in and I apologised profusely for my tardiness. Many of the questions from the previous talk came up, and I was asked to expand upon some of my answers. Another advantage to this two part system is the time it gives candidates to come up with decent, well researched answers. Given the ratio of interviewers to candidates, the questions came fairly rapidly. Many covered technical areas which I fortunately felt fairly confident about. Naturally, questions were asked about my IT experience, education and the case that I had recently investigated. I was asked to put myself into theoretical computer forensic circumstances and explain how I might respond and why. We talked at length on E-Discovery and the E-Discovery Reference Model, which I found interesting as this had not been covered in any depth on my MSc course. Soon enough it was lunchtime and hands were shaken and I was back on the street with an immense sense of relief. Usually I find that after interviews and examinations I struggle to be objective and this occasion was no exception; I truly could not decide whether I had completely blown my chances by my unfortunate entrance and lateness. The following days seemed to grind by. Eventually they became weeks, and although I kept in touch with the recruiter (possibly to the point of annoyance!) there was no news. Then finally one Friday I took the call telling me that I had been offered the position of Forensic Analyst.

From my perspective a few weeks into my new career several things have become clear. The first is how fortunate I am to be here; although I am pleased to have moved on from IT support, this practical experience was more valuable than I had realised – particularly in conjunction with some real computer forensics experience. I know of several peers who have taken less than ideal positions in other fields such as support or programming since graduation. These are intelligent, skilled forensics graduates who simply have no experience and cannot afford to take unpaid work in order to gain any now. Practical experience, however it is gained, seems to be very high on graduate employers’ wish lists. A genuine interest in technology, familiarity with computer forensics terminology and a confidence with hardware helps. Finally, I find that a desperate dash through the streets of London on a warm August morning seems to work wonders...

--