Digital Forensic Specialist at SNG GrantThornton

Role Purpose

• To support and conduct digital forensic investigations by collecting, preserving, analysing, and reporting on digital evidence. The role focuses on uncovering fraud, misconduct, data breaches, and cyber-related incidents through the application of established digital forensic methodologies and tools.
• This is a senior specialist role requiring extensive experience in leading complex digital forensic investigations, providing technical oversight and quality review of forensic work, and mentoring junior team members.
• The Digital Forensic Specialist will be responsible for handling complex forensic matters, providing technical guidance to junior team members, and working closely with forensic investigators, legal teams, clients, and other stakeholders to deliver accurate, timely, and defensible forensic findings.

Key Responsibilities

Digital Evidence Handling

• Acquire, preserve, and forensically image digital evidence from endpoints, servers, mobile devices, and other digital media in accordance with established forensic standards.
• Maintain accurate chain-of-custody documentation and ensure the integrity, security, and confidentiality of all digital evidence.
• Plan and execute evidence collection activities for complex investigations.
• Provide guidance to junior team members on evidence acquisition, preservation, and handling procedures.

Forensic Analysis

• Conduct advanced forensic analysis of digital evidence to identify fraud, misconduct, data breaches, unauthorised activity, and other suspicious behaviour.
• Analyse email, file systems, operating systems, browsers, applications, logs, and other relevant digital artefacts, including the recovery of deleted or hidden data.
• Develop timelines and correlate evidence from multiple sources to establish facts and support investigative findings.
• Review forensic analysis and provide technical guidance on complex or sensitive investigations.

Investigations Support

• Provide digital forensic support across fraud, misconduct, cyber, litigation, regulatory, and other investigative matters.
• Work closely with investigators, legal teams, clients, and internal stakeholders to determine evidence requirements and appropriate forensic approaches.
• Provide specialist technical input on the interpretation and relevance of digital evidence.
• Manage assigned forensic activities and deliverables in line with agreed scope, quality standards, and timelines.

Cyber & Data Analytics

• Support cyber investigations and incident response through forensic acquisition, analysis, and identification of indicators of compromise and suspicious activity.
• Analyse system, security, application, and other relevant data to identify anomalies, trends, and potential threats.
• Apply data analytics, scripting, automation, and other appropriate technologies to enhance forensic investigations.
• Correlate digital forensic findings with other investigative and analytical information to support conclusions.

Reporting & Presentation

• Prepare clear, accurate, and defensible forensic reports covering methodologies, evidence examined, findings, and conclusions.
• Ensure findings are supported by appropriate evidence and meet required forensic and quality standards.
• Present and explain forensic findings clearly to investigators, clients, legal teams, and technical and non-technical stakeholders.
• Review forensic reports and support legal, disciplinary, regulatory, or other formal proceedings where required.

Team Support & Development

• Act as a senior technical specialist within the team, providing oversight, quality assurance, coaching, and mentorship to junior and intermediate digital forensic practitioners.
• Provide technical guidance, coaching, and mentoring to junior and intermediate digital forensic team members.
• Assist with the coordination and allocation of forensic activities and provide oversight on assigned work.
• Support quality assurance and adherence to forensic methodologies, procedures, and professional standards.
• Contribute to knowledge sharing and the continuous improvement of forensic processes, tools, and working practices.

Minimum Requirements

Qualifications

• Degree in Computer Science, Information Systems, Digital Forensics, Cyber Security, Information Technology, or a related field.
• A postgraduate qualification in a relevant discipline will be advantageous.

Experience

• 8+ years' experience in digital forensics, data analysis, IT audit, cyber investigations, incident response, or a related field.
• 3+ years' experience in a supervisory, team lead, or managerial capacity, with responsibility for guiding or managing team members and/or forensic assignments.
• Proven experience in end-to-end digital forensic investigations, from evidence acquisition through to analysis and reporting.
• Experience handling complex fraud, misconduct, cyber, data breach, litigation, and regulatory matters.
• Strong practical knowledge of forensic tools, evidence analysis, and multiple digital environments, including endpoints, servers, mobile devices, and email.
• Experience providing technical guidance, reviewing forensic work, and engaging with multidisciplinary teams and senior stakeholders.
• Ability to manage multiple investigations and competing priorities while maintaining quality and attention to detail.

Certifications – Advantageous

• CISA – Certified Information Systems Auditor
• CHFI – Computer Hacking Forensic Investigator
• EnCE – EnCase Certified Examiner
• NUIX certification
• Cellebrite or similar mobile forensic certification
• Other recognised digital forensic application or cyber security certifications

Professional Memberships – Advantageous

• ACFE – Association of Certified Fraud Examiners
• IACIS – International Association of Computer Investigative Specialists
• Other recognised digital forensics, cyber security, audit, or investigation professional memberships

Key Skills & Competencies

• Advanced digital forensic analysis and investigation skills
• Strong understanding of digital evidence handling and chain-of-custody requirements
• Strong analytical and problem-solving abilities
• Good understanding of cyber security and incident response principles
• Ability to analyse and interpret large volumes of digital evidence
• Strong report-writing and presentation skills
• Ability to communicate technical findings clearly to non-technical stakeholders
• Ability to work independently on complex investigations
• Ability to provide guidance and mentorship to junior team members
• Strong attention to detail and commitment to evidence integrity
• Good stakeholder and client management skills
• Sound judgement, discretion, and professional integrity
• Ability to manage competing priorities and work under pressure