Associate - Forensic Cyber Investigations (2027 Graduates)

About the role

EY's Forensic Technology team, part of the Forensic & Integrity Services practice, offers digital forensics and eDiscovery services. This Associate role suits 2027 graduates and covers the full life cycle of investigations, from data scoping and collection to analysis, production and reporting. It works with clients across many industries, from incident response and cyber investigations to litigation and regulatory response.

Key responsibilities

• Support the collection, processing and management of large sets of digital evidence (electronic communications, documents and records).
• Support digital forensic analysis and reporting from the Forensic Technology lab and/or client sites.
• Support investigations with forensic and eDiscovery technology to speed up fact-finding.
• Help develop and document new procedures and workflows, and support the deployment of eDiscovery solutions.
• Produce electronic records for counsel, clients and authorised third parties, and resolve client requests during the review stage of eDiscovery engagements.
• Use industry-standard software to build custom solutions for clients, and write work papers, schedules and reports.
• Assist in cyber response and cyber-attack investigations, analysing artifacts from compromised machines and determining root causes.

Required profile

• Bachelor's or Master's degree in Computer Science, IT, Cyber Security or a related field.
• Solid knowledge of IT infrastructure and security, and familiarity with threat intelligence and incident response.
• Experience in complex investigations (digital forensics, log analysis, eDiscovery, data analysis, timeline creation) and with malware analysis and attack techniques.
• Ability to travel to client locations and to learn and adapt to complex situations involving large data sets.
• Experience in evidence seizure, chain of custody, data collection and host-based forensics.
• Strong communication skills, able to explain technical findings to technical and non-technical audiences and understand legal implications.

Required skills

• Certifications or progress toward them: EnCE, CCE, CCFP, GASF, GCFE, CFCE, CCME, GREM, Nuix or Relativity certifications, GSE, GCFA, GCIH, GNFA, OSCP, CEH, CHFI.
• Tools: EnCase, Cellebrite, Axiom, Oxygen Forensics, Relativity, Nuix, ELK, Splunk, Wireshark, AWS monitoring, Azure Sentinel, SIFT Workstation, IEF, Volatility.
• Cloud data collection (AWS, Azure, GSuite, Office 365) and host-based forensics on Windows, Unix and Mac.