NDES - Digital Forensic Investigator - Counter Terrorism Policing SO15

Want to work on some of the most important and high-profile investigations at the heart of Counter Terrorism Policing (CTP)? This is where you need to be. As a Digital Forensic Investigator in our team, you’ll put your skills to work where it matters most.

Join us, and you’ll be part of a team providing key digital forensics to CTP in London and beyond. Your main task will involve using established computer forensic techniques to identify relevant data or files. You’ll then add context to how that data was created or obtained, by whom and when. Once you have this information, you will prepare and present it in technical evidential reports or statements. You’ll also extract specific data for parallel viewing by Digital Media Assessment professionals.

It’s a varied role where you never know what you’ll be working on next. You could be using specialist tools and training to make forensically sound copies of digital devices and then analysing the contents. Or you might be detailing how a computer or mobile device was configured, what software was used, what documents pictures or videos were created, what web-sites were visited, and what emails were sent and received.

Sound theoretical knowledge and practical experience of digital forensics is therefore essential, but that’s not all. You’ll also need to work methodically, have confidence in your accreditation or experience, and be comfortable presenting your work at court. Above all, you’ll be as determined as we are to protect the UK. For you, that means keeping an eye on new technology, its use and how we could stay ahead of advances to keep Londoners, and the wider country, safe.

In return for your skills and dedication, you can expect a competitive salary, a Civil Service pension, excellent career development and one of the most rewarding roles around.

Key Tasks

The post holder will be required to do the following:

• Use specialist tools and training in order to make forensically sound copies / images of digital devices and then analyse the contents.

• Make links between suspects and digital evidence, which may include recovering encrypted or deleted data and then presenting it in an evidential format. The data will be examined in detail to build a picture of what the digital device has been used for in order to support an investigation.

• Detail how a computer or mobile device was configured, what software was used, what documents pictures or videos were created, what web-sites were visited, and what emails have been sent and received.

• Attend scenes, in company with the Forensic Management Team (FMT), to analyse devices in situ where it is believed that switching off or moving a device could possibly lead to a loss of evidence.

• There is an expectation that any successful candidate will fulfil the ‘On Call’ examiner role in due course.

• With experience a Digital Investigator may be appointed as a lead examiner for an investigation and so this may involve close work with Senior Investigating Officers, other partners in Digital Investigations and outside partner agencies.

• Support the unit by identifying future needs / trends in the digital forensics arena and carry out relevant project work, in order to enhance operational capability and future effectiveness.

Vetting

This post requires access to the most sensitive intelligence material on a daily basis. Applicants must hold or be prepared to undergo National Security Vetting (NSV) Developed Vetting (DV) level before taking up the post.

Additionally, this material is of particular sensitivity to the UK and its distribution must be restricted to UK nationals. In approved circumstances dual nationals (of which one element is British) may also be granted access. However, in the event that potential conflicts of interest cannot be managed the post holder will not be able to see the intelligence material and will not be able to perform their duties. For the purpose of safeguarding national security and in line with Cabinet Office Policy, supported by Section 82(2) to (4) of the Police Reform Act (2002), applicants who do not hold or acquire Security Check (enhanced) (SC(e)) OR Developed Vetting (DV) clearance and meet the nationality requirements cannot be offered the post.

Confidentiality Agreement

Applicants should also be aware of the need to sign a confidentiality agreement on taking up the post.

Our Employee Commitments

Counter Terrorism Policing aims to create an inclusive and welcoming atmosphere and culture and an environment where all our people feel a strong sense of belonging and are able to reach their full potential. Where any group or individual can be and feel respected, supported and valued to fully participate and contribute to our mission of "Working to keep people safe from Terrorism".

Inclusion, diversity and equality is at the front and centre of our approach to make the composition of Counter Terrorism Policing more representative of the communities we serve. As Counter Terrorism is rooted in Local Policing, to tackle today’s complex policing challenges, applications from across all communities are therefore essential and encouraged. Counter Terrorism Policing as a network is committed to ensuring that disabled people and those with long-term health conditions have the opportunities to fulfil their potential and realise their aspirations’., The Met is committed to being an equitable (fair and impartial) and inclusive employer for disabled people, striving to have a diverse and representative workforce at all levels. We encourage applications from people from the widest possible range of backgrounds, cultures and experiences. We particularly welcome applications from people with disabilities and long-term conditions, ethnic minority groups and women.

As a Disability Confident employer, the Met has committed to making disability equality part of our everyday practice. We ensure that people with disabilities and those with long term conditions have the opportunities to fulfil their potential and realise their aspirations.

The Met is committed to making reasonable adjustments to the recruitment process to ensure disabled applicants can perform at their best. If you need any reasonable adjustments or changes to the application and recruitment process, we ask that you include this information within your application form. All matters will be treated in strict confidence.

Please note, if you are applying for a police officer role or to become a police community support officer (PCSO) or designated detention officer (DDO), there is a minimum requirement that you must pass a job-related fitness test (JRFT) at point of entry. This does not apply to police staff roles. Find out more about

• A current theoretical and practical knowledge of computing and computer operating systems. Evidence to demonstrate a good understanding of computer networking including server-client and peer-to-peer configurations.

• Achieved accreditation for one or more digital forensic tools (computer and / or mobile devices) or have other recognised learning / experience in the digital forensics field.

• A working knowledge of the ISO17025 standard and its implications on digital forensics laboratories.

• The successful candidate should be prepared to join a 24/7 call out scheme, potentially work extended hours at short notice to achieve urgent investigative objectives and possibly undertake CBRN training. This role may also involve overseas travel for operational purposes.

Essential

• A willingness to undergo and positively engage in the DV process. Appointment may be subject to successfully obtaining DV status.

• A current full UK driving licence with no more than 6 points.

• Candidates must understand that the nature of the work involved may expose them to potentially distressing material such as pictures and video files of death, extreme violence or child abuse. The candidate must be willing to undergo any psychological assessments required by the Unit Management as part of its responsibility towards staff welfare.

Desirables

• A recognised formal qualification in computer science (including forensic techniques) and / or a recognised general certification in computer / mobile forensics (such as the IACIS CFCE or Cranfield University Forensic Computing MSc Foundation course) and / or a recognised product specific certification (such as the Guidance Software EnCE or the AccessData Forensic Toolkit ACE or Cellebrite CCLO/CCPA or X-Ways X-Pert).

• Knowledge / experience of any of the following: Apple and Linux operating systems, Internet data analysis techniques, wireless survey techniques, network investigative techniques, scripting / programming. or "Malware" analysis.

• Vetting to at least DV (STRAP).

Additional Information

The following competencies will be tested against during sift:

• We analyse critically at level 2

• We are innovative and open-minded at level 2

• We are emotionally aware at level 2

The following values will be tested against during sift:

• Professionalism

• Integrity

Counter Terrorism Policing is committed to creating an inclusive working environment. We welcome and encourage applications from candidates who are seeking flexible working arrangements, including part time working or job share. In addition, this role has been reviewed following learning from work during the Covid pandemic and may be done in an agile manner. In the first instance, please contact the vacancy holder to discuss how such arrangements could be accommodated (where applicable).