Advice for Digital Forensics Job Seekers

by Joe Alonzo

You see the job advertisements posted on the web everyday, Digital Forensics Analyst, Internet Investigator, Computer Forensic Associate.  You hit the Apply Now button, often never hearing back from said company.

Your background may consist of computer programming/IT, network security or possibly even a background in law enforcement. You ask yourself, How do I get the attention of this organization and get them to hire me?

Working for the leader in Computer Forensics and eDiscovery recruiting and seeing all the good and bad candidates I have done, I hope to give you some great insight on how to get your dream job.

Below we will categorize computer forensics jobs in three areas, Big4, next level consultancies and major corporations. I will highlight some key facts on each industry, and offer advice on how to get that dream job.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.



A great place to start your career and obtain corporate, consultative experience is within Big4.  In the opinion of The Glenmont Group, Big4 is a better place to work earlier in your career, many recruiters (and candidates) would tend to agree. We cannot say which firm has the best practice, but can tell you what these companies look for in a candidates and ways to get your foot in the door.

Since we are talking about ‘how to get the job you want’, most of what you will apply for will be the junior to mid-level opportunities.  Also referred to as Associate positions, sometimes “Senior” Associate with slight variations throughout.

These are opportunities that require a candidate to have one to five years of working experience, and offer you the ability to “climb the corporate ladder” of Big4 if you wish to do so.  Getting hired within an organization like this requires you to have a Bachelors degree at the very least and at least one year of experience typically a technical environment.

These roles are ideal for the younger professional, usually with an IT background. Rarely am I asked to find someone with a background in law enforcement for positions like this.  There are always exceptions to this, for example if you have commercial readiness experience (read: business savvy, articulate, can present to clients), then you stand a good chance of getting your foot in the door.

We receive calls regularly from retired police officers or detectives wishing to apply for entry level roles.   In most cases junior level roles within the Big4 are not an ideal fit.  Because you are applying for a position at a lower level, expect the pay to be on the lower range of compensation (average 55K-85K US), expect to work long hours, sleep very little and have little or no time for social life.

The average first year or second year Associate within Big 4 works about seventy hours per week and travels two to three weeks per month.


The good news

The experience you obtain in Big4 is invaluable; most recruiters tell you the same.  Spending two years as a first or second year associate is equivalent to four or five years within a corporation or average consulting firm, not to mention it is fantastic for your resume. You become very appealing to corporations and solutions providers as having a certain level of professionalism about you.  And such, this makes an easier transition into the traditional corporate or boutique setting.

Big4 has what is referred to as “up or out”, which as implied means you either work your way up or you are asked to leave.  There is a well defined career path with salary increases and different levels of responsibilities at each.

Titles can vary depending on the organization, however here is what the career path looks like in one particular organization:

  • First year Associate  $50 – 65K
  •  “Senior” (Associate) $65 – 80K
  • Manager  $80 -110K
  • Senior Manager $110 – 220K
  • Partner $220++

(Salaries vary depending on  region, figures can be +/- approx  $10,000 )

Continuing your career within Big4 is not a terrible thing especially if you are money motivated.  Partners (sometimes Principles) in Big4 earn an average salary of $250,000 and as high as $900,000 in some cases.  Put a bonus on top of that and stock options and you’re well over one million dollars.

Next level consultancies

As a recruiter in the space, some of the most advanced candidates we see come from companies such as FTI Consulting, BDO Seidman, Navigant Consulting and similar organizations. These companies work in a slightly similar fashion to a Big4, however we see a bit more hands on technology expertise as well as the client facing abilities in a candidate like this.

Getting your foot in the door at a technology consultancy can sometimes be an easier route compared to Big4; still a competitive environment but not as cut throat.  A Bachelor’s degree in Computer Science, Engineering or a related field as well as a minor background in technology and you are a strong candidate for an entry level role.

Having a technology certification like CISSP, CEH, MCSE or A+ is always a plus and may enhance your chances of getting the job you want.

Starting US salaries at companies like this range from $60-80K plus bonus.

Useful link regarding industry certifications…click HERE


This may come as a surprise, however many of the Fortune 2000 have a relatively small computer forensic department compared to the size of the company.  Due to the fact the work is usually for internal investigations, sometimes used in defense in litigation, or most commonly as a preventative measure in commercial litigation (referred to as litigation readiness).

As a recruiter, we frequently see computer forensic jobs coupled with electronic discovery roles in major corporations.  A question often asked by senior management is “where is this group housed?”,  “Do we put the group in legal, or do we put the group in IT?”, and  “who pays for this budget?”

Typically computer forensic jobs “in-house” are not as competitive with salary; however computer forensic/eDiscovery jobs are growing within corporations every year.

“a growing trend to bring electronic discovery in-house.  It would be appealing to me as a hiring authority to see a mix of consulting companies and in-house experience on a candidate’s resume.”

“As a candidate moving in-house from a consultative role, you tend to make less money however the experience you gain working in-house is great for your career, as it adds legitimacy to understanding internal corporate needs.” says  Sergio Kopelev, Director of Huron’s eDiscovery practice in Los Angles.

Some of the most sophisticated computer forensic departments are in the financial industry.  Investment firms like Barclays Capital, Credit Suisse and Bank of America already have strict information security or threat management systems in place, so the framework to add computer forensics on top of that is already in place.

Below is a computer forensic analyst opening posted online. When responding to a job posting online, be sure your resume matchers up closely with the job requirement.  It is also important to have any industry certification listed at or near the top so it catches the eye of the person viewing your resume.

One of the first things you’ll see listed under SKILLS and REQUIREMENTS is that this opening requires someone with a CCE. In a role like this where a the certification is listed first, don’t expect to hear back from the company unless you have the required certification or something similar.

The company is also looking for someone with at least three years of forensic experience in an investigative manner.  If you have one or two years, you probably have a strong chance of being selected for an interview at the very least.

You might also notice things listed like DOS, Windows, UNIX, Linux and SQL.

Items listed at the top of the requirements section in job advertisements are typically the most important, whereas things listed near or at the bottom are usually a “nice to have”.



  • Perform forensic imaging and data recovery (in-house and on-site).
  • Conduct computer forensic investigations, analysis, and electronic discovery for corporate clients.
  • Provide detailed reports, author affidavits, attend depositions, and provide testimony if necessary.


  • CCE certification required.
  • 3+ years of computer forensics experience in an investigative capacity.
  • Direct experience with imaging/analysis technologies, EnCase, X-Ways, Helix, Trident,FTK, and other forensic and electronic discovery tools.
  • Strong hands-on experience with computer hardware, servers, networks, PDAs, and cell phones.
  • Solid experience with DOS, Windows (all versions), UNIX, LINUX, and MacOS.
  • Experience with SQL, MS-Exchange, and Lotus Notes strongly preferred.
  • Scripting/programming experience a big plus.


Job descriptions are like recipes.  You can usually accomplish what you want without all the required ingredients as long as you can improvise.

This is clearly a role which requires someone with a technical background versus a background in law enforcement, however if you are technical and have a solid grasp of at least 70-80% of the required “ingredients” then you stand a good chance of getting called in for an interview.

The power of the internet

Because of social networking and media sites like Facebook, Twitter, LinkedIn and Plaxo, it has become much easier to connect with other professionals in your industry.  A great tool for entry level candidates is to seek out managers and directors at companies of interest and attempt to network and establish some dialog.  LinkedIn is especially useful when it comes to finding people because of its Advanced Search function.  The text boxes in LinkedIn can reportedly handle up to one thousand characters which makes Boolean searching relatively easy.  You can see in the diagram below the ability to search by title using OR as a connector.  A search string consisting of Director OR Manger OR “computer forensic” will yield results with professionals having those words in their job titles.

I also highly recommend joining groups on LinkedIn with a focus on Computer Forensics.  Aside from industry talk, you will likely see many jobs posted that may be of interest to you.  A few of the better forensic groups are Digital Forensics Magazine,  Digital Forensics Association (DFA), Financial Crime, Risk, Fraud and Security, Forensic Focus,.  Each of these groups has several thousand computer forensic professionals, many at the hiring level.


Interviewing tips, the big day is approaching…

I’m going to mention some very important things about interviewing, many of which you may say to yourself, “of course, I would never do such a thing”.  I cannot tell you how many times I’ve seen candidates cost themselves the job by forgetting a few simple rules.

Some Do’s and Don’ts

Spend some time researching your perspective employer.  It is not necessary to go back to the roots of the company, but some knowledge about them shows the interviewer that you took the initiative to learn about their organization.

Get to the interview about ten to fifteen minutes early.  If you arrive an hour early, spend the time in your car or find a place nearby to kill time.  You don’t want to be the creepy person sitting in reception for ninety minutes.

Be nice to the receptionist.  Don’t be fooled by their job title, sometimes the receptionist is asked how you treated t hem during your arrival and departure.

Be courteous to anyone you see in elevators or hallways.  You could be standing next to your future boss and not even know it.

Eat a good breakfast.  With an ever competitive job market, it’s not uncommon to spend four to five hours interviewing for a position.  Ignoring breakfast may cost you valuable thinking power needed to get the job you want.

Treat the interview more like a conversation than a question and answer session. Try to be as engaging as possible and talk about fifty percent of the time.  Prepare questions ahead of time to present to the interviewer.

Keep your answers concise; avoid going too far off topic.  Make as much eye contact as possible when speaking and do not interrupt anyone else when it is their turn to speak.

Send a Thank You email within twenty four hours after the interview.

Do not talk about your current employer in a negative light.  Aside from being highly unprofessional, it sends the message that you may do the same about them when interviewing for future position.

Always keep everything in the positive sense. Do not mention that your current position is too stressful or your work too many hours.  All jobs can be stressful at times; you may cost yourself a great opportunity if you mention you cannot handle a bit of stress.

Avoid telling the interviewer(s) you need to be a manger in two to three years. Many entry level jobs do not offer a path to management in the first twenty four months. Even the position does offer a management track, avoid bring up the topic.   Remember, you are interviewing for a worker bee role, not the queen’s job.  The person conducting the interview may give you an unfavorable review if he/she thinks you want their job.

Unless otherwise directed, do not talk about vacation, time off or ask how many hours are required in normal work week.  You will get answers to these questions in an orientation packet or during your first few days of work.

Other important things to avoid:

  • Do not chew gum during the interview
  • Try not to smoke just before the interview
  • Do not get dressed in the bathroom
  • Talking on your cell phone in the reception area can be hazardous, exit to a common area
  • Leave the coffee or water bottles in the car, or throw them way.  You’re almost always offered tea, coffee or water at the start of the interview.



You can never be overdressed, dress to impress.  It is very important that you dress for the job you want, not the job you have.  Unless the hiring authority or HR person tells you to come in wearing shorts, it’s always a wise idea to wear freshly pressed dark colored suit, clean polished shoes (black or brown) and tie.  Socks should also be dark and absolutely not white

For the ladies: Women should dress conservatively, with either a business suit or skirt. Do not show cleavage, one button open on top is fine and knee length skirts are acceptable.  Flesh colored stockings are a good idea as well. Avoid wearing large or dangly earrings.

For the gentlemen: Don’t forget to shave/trim your beard. Heading to an interview with scruff or a five o’clock shadow says a lot about your character.  It shows you have little regard for your interview that day or you were too lazy to shave. Men should avoid any type of odd piercings or earrings.

Wild hairstyles and bright colored hair are a great way to get noticed, but not a great way to secure your career. A trim haircut or pulled back hair is the way to go.

Your typical navy, black or dark grey suits are usually considered “recruit suits” and are your safest bet.


Your resume

Gone are the days of one page resumes. We live in evolving and dynamic times with tech startups, companies closing their doors due to economic downturn, VC pulling the funding, etc

Do not worry if your resume goes onto a second page, a third page is a stretch.  Anything beyond three pages and you can almost guarantee your job search will last longer than you had hoped.

We tell candidates to list their education at the top of the resume if they had an excellent GPA, graduated with honors or Cum Laude.  For example, you may want to list your University near the top of your CV if you attended Champlain College and you want a job in the digital forensic space.


About the author

Joe Alonzo has been in the executive search space for eight years. Initially working in the Wall Street technology market, his main focus was placing computer programmers and database developers within the major investment banks on Wall Street.  This led to his current role as Director of Electronic Discovery and Computer Forensics.  In 2009, Joe joined The Glenmont Group, a highly respected leader in litigation technology search.  The Glenmont uses state of art technology and advanced sourcing methods to attract and locate the top professionals in the legal technology market.

Joe has placed dozens of individuals in forensic and eDiscovery organizations over the past two years and is considered an expert when it comes to understanding the dynamics of recruiting.  Joe takes a very intellectual approach to recruiting and has helped his candidates leverage their current experience into very rewarding careers.


2 thoughts on “Advice for Digital Forensics Job Seekers”

Leave a Comment

Latest Videos

Digital Forensics News Round-Up, May 22 2024 #dfir #computerforensics

Forensic Focus 14 hours ago

Podcast Ep. 85 Recap: AI-Powered License Plate Reading With Amped DeepPlate #dfir #digitalforensics

Forensic Focus 21st May 2024 1:57 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles