Description
Investigate cybercrimes and technology-enabled offenses by collecting, preserving, and analyzing digital evidence to identify offenders, mitigate harm, and support prosecution under applicable laws.
- • Conduct initial triage of victim networks and systems for active compromise and ongoing threats.
- • Interview complainants, witnesses, and suspects; record and preserve digital statements and chats.
- • Secure compromised devices, servers, and cloud accounts to prevent tampering before forensic imaging.
- • Document investigative actions, maintain case files, and draft affidavits for digital search and seizure warrants.
- • Prepare charging recommendations and case packets in accordance with digital evidence procedures.
- • Preserve, image, and analyze digital evidence; maintain chain of custody and dispose of evidence per policy.
- • Obtain incident summaries from responders or reporting agencies without altering evidence.
- • Capture screenshots, metadata, and timestamps; map network topologies and collect relevant logs.
- • Prepare detailed reports of findings and timelines of cyber events.
- • Query databases and agency records to identify suspects, aliases, and infrastructure.
- • Control access to affected environments and coordinate to prevent evidence contamination.
- • Provide forensics labs with context, suspected vectors, and requested examinations.
- • Review incident and patrol reports to determine gaps and next investigative steps.
- • Corroborate evidence through interviews, log analysis, OSINT, and transactional records.
- • Draft and execute search warrants and subpoenas for devices, ISPs, cloud providers, and blockchain data.
- • Conduct online surveillance and validate identities across platforms and services.
- • Define offense elements and the digital artifacts required to prove them.
- • Assist with on-site digital evidence seizure during raids and arrests.
- • Lead digital crime scene operations, assigning imaging, triage, and log collection tasks.
- • Coordinate victim assistance and incident response resources.
- • Notify command and request specialized technical support when needed.
- • Testify before grand juries and in court regarding cyber investigations and findings.
- • Isolate networks, disable accounts, and preserve volatile data to secure the digital scene.
- • Notify prosecutors and obtain guidance on legal process and charging decisions.
- • Collect artifacts such as logs, memory, disk images, malware samples, and network captures.
- • Set investigative scope, priorities, and timelines based on threat and legal constraints.
- • Monitor threat actor infrastructure, domains, forums, and dark web marketplaces.
- • Coordinate with federal, state, local, and international partners and ISACs.
- • Conduct undercover online operations and monitor authorized intercepts.
- • Analyze linkages among accounts, IPs, crypto wallets, and transactions to build chains of evidence.
Related specializations
Interview options
Interview options
Interviewee gender
Interviewee accent
Available on paid plans only
Interview time
Related Pathways
Public Service & Safety
View
Source
Tasks & skills:
O*NET occupational data (work activities, skills, knowledge).
Learn more
Sources & Standards:
This site includes information from O*NET by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), used under the CC BY 4.0 license. Career Clutch has modified some of this information for student readability. USDOL/ETA has not approved, endorsed, or tested these modifications. O*NET® is a trademark of USDOL/ETA.
Last reviewed: Jan 2026
