Clarification from the agency

MERIT PROMOTION (MP) VACANCY ANNOUNCEMENT - Current Federal employees with competitive status; Former Federal employees with reinstatement eligibility; CTAP/ICTAP eligibles; Veterans with VOW, VEOA, or 30% disability; Military Spouses. Those eligible under an OPM interchange agreement.

Videos

Please note: This position has a Selective Placement Factor that must be met and supported by your applicant package.

This position is located in EPA, Office of Inspector General, Office of Investigations, Electronics Crimes Unit. If selected, you will be responsible for providing investigative support to all elements of the OIG in the seizure or collection of digital, electronic, or computer-related evidence.

Investigative findings may form the basis for criminal or civil prosecution by the Department of Justice; civil action by EPA.

This position is designated as a “Primary Position” pursuant to 5 CFR 842.802. Primary duties mean those duties of a position that: (a) Are paramount in influence or weight; that is, constitute the basic reasons for the existence of the position; (b) Occupy a substantial portion of the individual's working time over a typical work cycle; and (c) Are assigned on a regular and recurring basis.

The ideal candidate will perform the following duties:

• Evidence Collection: Securely seizing, imaging, and preserving digital storage devices (hard drives, mobile phones, USB drives) to prevent data alteration.
• Provides on-scene technical support and assistance during the execution of search warrants.
• Uses software and hardware forensic tools to extract, preserve, analyze, and present evidence for further investigations or testing.
• Data Analysis: Using specialized tools (e.g., Cellebrite, Magnet Forensics) to examine data, including deleted files, emails, passwords, and multimedia.
• Reporting: Documenting findings in detailed reports for use in legal proceedings.
• Serves as subject matter expert on technical matters relating to digital evidence and testify in court or at hearings as an expert witness in the area of digital forensics.
• Supports investigations into cybercrimes and crypto currency fraud: Technical investigations in crimes involving but not limited to fraud, sexual exploitation, and violent crimes involving digital devices.
• Perform systems updates, regular maintenance and Lifecyle replacements of all forensic devices.
• Performs other duties of a similar nature and level as assigned
• May serve as contract representative with vendors.
• Works closely with other personnel within the OIG, EPA, law enforcement organizations, and professional business community in investigating and resolving allegations of criminal, civil, and administrative misconduct.

Conditions of employment

• You must be a U.S. citizen.
• Background Investigation Required.
• Pre-employment physical is required and periodic physicals thereafter.
• Pre-employment drug testing is required and random testing thereafter.
• You must possess a valid drivers license.

Work Schedule: The hours are generally set; however, you may be required to work hours that are long and irregular. You may also be sent on extended temporary duty station assignments away from your assigned office. You may be reassigned to different duty locations throughout the U.S. based on the needs of the Agency.

Incumbent must have successfully completed a digital forensic OR exploitation course from a recognized vendor or Federal Agency, Department of Defense OR an equivalent and recognized training program. Your certificate of completion MUST be provided at the time of application.

Applicants must possess a valid state driver's license or be able to operate a Government-owned or leased motor vehicle and obtain a government travel card.

Incumbent will be required to obtain and maintain a top-secret security clearance.

Demonstrated experience in the field of digital forensics, including assembly and disassembly of physical devices.

Experience in programming or scripting language(s).

Previous experience in computer science in a development or engineering capacity.

Technical reporting/writing.

Relational Database experience with products such as MySQL, SQL, etc.

U.S. citizen; Selective Service registration (if applicable); Top Secret clearance; Pre-employment drug testing is required and random testing thereafter.

Qualifications

All applicants must have 52 weeks of specialized experience. Specialized experience is experience that equipped the applicant with the particular knowledge, skills, and abilities to perform successfully the duties of the position, and that is typically in or related to the work of the position to be filled. Experience may have been obtained in either the federal service or its equivalent with state or local government, the private sector, or nongovernmental organizations.

GS-13: You must possess one year of specialized experience equivalent to at least the GS-12 level or equivalent band of responsibility in the Federal service to include: GS-13: You must possess one year of specialized experience equivalent to at least the GS-12 level or equivalent band of responsibility in the Federal service to include: 1) Knowledge of the techniques used in acquisition, examination, and analysis of digital evidence. 2) ability to prepare effective investigative reports and present information to stakeholders in an accurate, concise, and logical manner; 3) Knowledge of the processes and procedures involved in installing, configuring, and testing hardware and software on workstations, and peripherals in a networked environment.; 4) Knowledge of the functions and capabilities of network hardware and software in a networked environment; and 5) Knowledge of the component parts of personal computers, peripherals, servers, mobile devices, and their associated functionality.

Your resume will be evaluated based on the following competencies:

• Complex Forensic Analysis. Independently performing deep-dive forensic imaging and analysis on non-standard or encrypted file systems, including the use of hex editors and custom scripts to recover fragmented or intentionally deleted data.
• Evidentiary Integrity & Litigation Support: The ability to effectively write and present findings in an accurate, logical and concise manner. Leading the lifecycle of digital evidence—from seizure to courtroom presentation, including the successful defense of forensic methodologies under technical "Daubert" or "Frye" legal challenges.
• Standards & Validation: Managing the technical validation of forensic hardware and software (e.g., EnCase, FTK, Magnet AXIOM, Cellebrite) to ensure results are scientifically sound and repeatable for federal prosecution.
• Technical Leadership in Crisis: Serving as a primary technical lead during multi-faceted investigations, providing real-time guidance to junior examiners and coordinating the forensic workflow of multiple concurrent high-priority cases.
• Advanced Artifact Interpretation: Analyzing complex system artifacts (e.g., Windows Registry, LNK files, Shellbags, and Unified Logs) to reconstruct user activity and establish a definitive timeline of events for criminal or administrative inquiries.

Evidence of the above specialized experience must be supported by detailed documentation of duties performed in positions held. Your resume is the key means we have for evaluating your skills, knowledge, and abilities as they relate to this position. Therefore, we encourage you to be clear and specific when describing your experience. We will not make assumptions regarding your experience or based on job titles alone. If your resume does not support your questionnaire answers, we will not allow credit for your response(s). 

Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. 

Applicants must meet the qualifications for this position within thirty (30) days of the closing date of this announcement. 

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

All applicants: Your application will be reviewed in three phases to determine how you move forward in the hiring process.

Phase I: Your resume will be reviewed to determine your technical qualifications for this position based on the required specialized experience. ONLY two (2) pages of your resume will be reviewed. Additional information beyond your resume (e.g., cover letter, links embedded in your resume) will not be reviewed.

Applicants passing “Phase I” will move on to the “Phase II” of the assessment process where your application will be reviewed and rated based on the competencies listed in the vacancy announcement by a Subject Matter Expert (SME). Your qualifications will be evaluated based on your application materials (e.g., resume, supporting documents). Applicants who do not respond to the application questions may be rated ineligible. 

Applicants passing “Phase II” of the assessment process will be invited to participate in a structured interview, as part of “Phase III”. A SME panel will conduct the structured interview and assign a score for each of the five required competencies   listed below, based on your responses to the interview questions.

Your will be assessed on the following competencies:

• Knowledge and Conduct of Digital Forensics
• Knowledge of computer networking and configurations
• Written and Oral Communication
• Technical Investigations
• Evidentiary Integrity & Litigation Support
• Advanced Artifact Interpretation

NOTE: If you exaggerate or falsify your experience, education and/or your responses to questions, your ratings are subject to change or you may be removed from employment consideration.

Applicants who apply under this job opportunity announcement agree to have their application, associated documents and applicable personal information shared with other Offices within the OIG community who have vacancies with the same occupational series, grade, full performance level and in the same geographic location(s). Applying to this announcement does not replace the need to apply to other job opportunity announcements for which you wish to receive consideration. You may choose to opt in of having your information shared with other agencies when applying for this position. If an agency requests a copy of a certificate, you are on, you will be notified.