Please paste the following URL into a browser to view the entire job posting on the CAPPS Careers page.https://erphcmprd.cpa.texas.gov/psp/candidateportal/EMPLOYEE/HRMS/c/HRS HRAM FL.HRS CG SEARCH FL.GBLPage=HRS APP JBPST FLandAction=UandFOCUS=ApplicantandSiteId=1andJobOpeningId=106640andPostingSeq=1Agency InformationThe Texas Cyber Command (TXCC) is the state's front line of cyber defense, established by the 89th Texas Legislature to protect Texans, critical infrastructure, and government systems from evolving cyber threats. Headquartered in San Antonio (a national hub of cybersecurity talent), TXCC unites threat detection, incident response, and statewide cyber readiness under one mission-driven agency to establish Texas as the most cyber-resilient state in the nation. At TXCC, your work doesn't just sit in a queue - it actively secures, protects, defends, and educates over 31 million Texans every day.Job DescriptionThe Digital Forensic Investigator performs advanced (senior-level) cybersecurity analysis and digital forensic investigative work within Texas Cyber Command's Unified Cyber Task Force (UCTF), Digital Forensics Laboratory (DFL). The position collects, preserves, examines, and interprets digital evidence to establish what occurred, identify incident causes and scope of harm, and support response, recovery, and authorized investigations involving state agencies and other eligible entities, including critical infrastructure partners.Reporting to the DFL Director, the investigator works under limited supervision and exercises independent technical judgment in conducting assigned complex examinations. This senior, hands-on individual-contributor position produces defensible findings, contributes to laboratory improvements, and may coordinate assigned forensic casework and mentor personnel. The position does not supervise staff; laboratory management, policy approval, and overall case prioritization remain with the DFL Director.The investigator works closely with the Cybersecurity Incident Response Unit (CIRU), SOC Platform and Shared Services, the Cybersecurity Threat Intelligence Center (CTIC), Regional Security Operations Centers (RSOCs), and authorized investigative partners. CIRU leads assigned incident response; the investigator provides timely forensic support while maintaining DFL evidence-handling and examination requirements. Work is performed within assigned authority, approved agreements, applicable law, and established procedures.Essential Job DutiesPlans and conducts complex digital forensic examinations. Clarifies investigative objectives, confirms authorized scope, identifies relevant evidence sources, selects appropriate examination methods, and coordinates priorities and deliverables with Digital Forensics Laboratory (DFL) leadership and assigned incident or investigative personnel.Collects, acquires, preserves, and safeguards digital evidence using approved onsite and remote methods, including forensic imaging and acquisition of relevant system, storage, email, log, and other electronic data. Documents acquisition conditions, verifies evidence integrity, and maintains accurate chain-of-custody, access, storage, transfer, retention, and disposition records.Examines and analyzes digital artifacts to reconstruct events, recover relevant data, evaluate user and system activity, and identify unauthorized access, malicious activity, data exposure, or other significant findings. Correlates forensic results with available incident and investigative information and seeks specialized support when an examination exceeds available capabilities.Provides timely forensic findings to Cyber Incident Response Unit (CIRU) and other authorized personnel regarding affected systems, accounts, data, incident causes, scope of impact, and remaining evidence gaps. Explains implications for containment, eradication, recovery, and related investigative actions while clearly distinguishing preliminary findings from validated conclusions.Maintains contemporaneous examiner notes and complete case documentation describing evidence sources, examination methods, tool versions, significant settings, results, limitations, and other information necessary to support reproducibility and technical review. Prepares clear, objective forensic reports, briefings, evidence manifests, and supporting documentation for investigative, administrative, law-enforcement, or judicial purposes.Provides technical explanations, depositions, or testimony regarding forensic examinations, evidence handling, methodologies, and findings within the scope of the investigator's qualifications. Supports authorized eDiscovery, litigation holds, audits, administrative investigations, records requests, and related matters while maintaining appropriate separation from legal, personnel, disclosure, and other decision-making responsibilities.Recommends and implements approved improvements to forensic laboratory procedures, examination environments, evidence workflows, tool readiness, and quality practices. Evaluates forensic methods and tools, participates in technical peer review, documents limitations and corrective actions, and supports consistent and reproducible examination practices.Uses approved automation and technical workflows to improve evidence processing, analysis, and reporting. Defines forensic requirements, tests and validates workflows, verifies automated outputs against source evidence, documents processing history, and escalates unreliable results while retaining responsibility for analytical conclusions.Provides technical guidance, mentoring, and knowledge transfer to analysts and approved support personnel. Demonstrates forensic examination methods, evidence-preservation practices, case documentation, and report preparation and contributes to training, exercises, and professional development activities.Shares authorized forensic findings and technical information with CIRU, Security Operations Center (SOC)
