Forensics Jobs in Cottage Grove, MN (NOW HIRING)

Job Details
Working Title: Senior Digital Forensics Examiner
Job Class: Information Technology Specialist 5
Agency: Minnesota IT Services

• Job ID: 94402
• Location: St. Paul
• Telework Eligible: Yes, LI-Hybrid
• Full/Part Time: Full-Time
• Regular/Temporary: Unlimited
• Who May Apply: Open to all qualified job seekers
• Date Posted: 09/01/2026
• Closing Date: 09/10/2026
• Hiring Agency/Seniority Unit: Minnesota IT Services
• Division/Unit: Enterprise Security
• Work Shift/Work Hours: Day Shift
• Days of Work: Monday - Friday
• Travel Required: No
• Salary Range: $39.73 - $67.92 / hourly; $82,956 - $141,816 / annually
• Job Class Option: Information Security
• Classified Status: Classified
• Bargaining Unit/Union: 214 - MN Assoc of Professional Empl/MAPE
• FLSA Status: Exempt - Professional
• Designated in Connect 700 Program for Applicants with Disabilities : Yes

The work you'll do is more than just a job.
At the State of Minnesota, employees play a critical role in developing policies, providing essential services, and working to improve the well-being and quality of life for all Minnesotans. The State of Minnesota is committed to equity and inclusion, and invests in employees by providing benefits, support resources, and training and development opportunities.
Join the 2,800+ professionals of Minnesota IT Services (MNIT) who connect Minnesotans to services that will improve their lives. This position will be part of the Enterprise Security team, which embeds security protection statewide.
Job Summary
The Senior Digital Forensics Examiner (SDFE) assumes an advanced technical role within the MNIT Digital Forensics Laboratory (MDFL) to provide the State of Minnesota with digital forensics services based on established Enterprise policies, programs, laws, and regulations.
The SDFE conducts digital forensics investigations for internal investigations and security investigations. The SDFE is responsible for scoping, data acquisition, processing, advanced analysis, and reporting on the most complex and sensitive cases handled by the MNIT Digital Forensics Laboratory. This position may assist other government entities with investigations as well as consult with them on digital forensics and investigative matters. This position uses tools and investigative techniques to assess, acquire, analyze, document, and report on digital forensic artifacts, system-level details, metadata, and other investigative material associated with internal and security investigations. The incumbent conducts laboratory maintenance, develops laboratory procedures and processes, and performs research and testing on new technologies. The SDFE plays an integral role in mentoring and assisting other staff within the MNIT Digital Forensics Laboratory (MDFL).
You will be part of an forensics team that engages in a wide variety of important work. You will play a key role within the MNIT Digital Forensics Laboratory (MDFL) and assist with improving services, automation, implementing new technologies, developing documentation, and building key relationships with customers while continuing to expand your digital forensics and investigative knowledge.
This position requires onsite work at the MNIT Digital Forensics Laboratory (MDFL) located in St. Paul, MN; remote work may be available in accordance with State policy and laboratory operational needs .
Responsibilities

• Perform advanced digital forensics services for executive branch agencies to acquire, document, and report on digital forensic artifacts, system-level details, metadata, and other investigative material associated with internal investigations, security investigations, and other investigative requests.
• Provide digital forensic consultation and perform digital forensic services for State agencies and, as appropriate, limited third-party engagements, including evidence identification, forensic collection considerations, investigative approach, forensic tools and methodologies, and documentation related to digital forensic examinations.
• Manage digital forensics examinations through the entire lifecycle, including case planning, intake, acquisition, processing, examination, reporting and presentation, and testimony.
• Provide technical recommendations for developing enterprise-wide forensic standards and practices.
• Develop and document laboratory processes and procedures and provide training to laboratory staff as appropriate.
• Act as an expert witness on digital forensic examinations, including interpreting and presenting forensic findings and reports in legal proceedings. Assist other laboratory staff in deposition and testimony preparation and work with legal counsel as needed.
• Maintain the MNIT Digital Forensics Laboratory, including performing validations, developing forensic processes and procedures, and troubleshooting and resolving technical issues.
• Mentor other laboratory staff and serve as a team lead within the MNIT Digital Forensics Laboratory.
• Provide training and advice on forensic-related matters to a wide variety of audiences, including MNIT staff, agency legal teams, agency Human Resources teams, vendors, and other government partners.
• Partner with security teams as needed on security investigations to help determine investigative scope and impact.
• Research and stay abreast of new digital forensic methods, tools, processes, and best practices. Play a key role in advanced research and testing and develop standards for conducting research and testing.
• Understand MNIT Digital Forensics Laboratory policies, procedures, and processes and act as a subject matter expert in this area for other laboratory staff.

This position was previously announced on May 27, 2026. If you previously applied for this job opening, you do not need to reapply.
This position requires an employee to work onsite at 600 Cedar St, Minnesota at least 50% [or more or less if space limitations remain] of the time, with limited telework available. Telework eligibility depends on residence:

• Candidates living in Minnesota or within 50 miles of the worksite in a bordering state (Iowa, North Dakota, South Dakota, and Wisconsin) may telework up to 50%.
• Minnesota residents living more than 50 miles from the worksite may be eligible to telework more than 50%.
• Candidates living 50 miles or more from the worksite in a bordering state may work onsite 100% or may be telework eligible if relocating within 50 miles.

Qualifications
Minimum Qualifications
To qualify, candidates must clearly show all of the following qualifications in their resume. Resume tips available here :
Position requires a minimum of five (5) years of IT related experience in in digital forensics, role that includes experience supporting investigative work (e.g., internal, corporate, or criminal investigations).
Experience must include:

• Knowledge of digital forensics methodologies, industry standards, and best practices.
• Experience performing live system forensics, dead-box forensics, mobile forensics, and/or network forensics and conducting investigations, including scoping, data acquisition, data processing, forensic analysis, and reporting.
• Working knowledge and experience with computer hardware and the ability to work with a wide variety of hardware types, including desktops, laptops, tablets, smartphones, and Internet-of-Things (IoT) devices.
• Knowledge of general IT concepts and technologies such as databases, networking, scripting, system administration, application and system design, backup technologies, email systems, cloud services, and IoT devices.
• Experience with multiple operating systems (e.g., Windows, Linux, macOS) and multiple file systems (e.g., NTFS, EXT3/4, HFS, Android) as they relate to forensic investigations.
• Demonstrated ability to communicate clearly and effectively in a manner that facilitates mutual understanding.
• Customer-focused approach grounded in active listening, empathy, and solution-oriented problem-solving to deliver positive user experiences.

Education in Information Technology (IT) or an IT related field may substitute for experience as follows: a master's degree for eighteen (18) months of experience; a bachelor's degree for one (1) year; and an associate's degree for six (6) months.
Preferred Qualifications

• Experience with digital forensic tools such as Magnet Axiom, EnCase, Volatility, Cellebrite UFED / Physical Analyzer / Inseyets, Cellebrite Digital Collector, WinHex Specialist, Forensic Explorer, or similar forensic tools, as well as experience with Microsoft cloud environments, including Microsoft Purview, Azure, Entra ID, and Microsoft 365 services, with an understanding of how these platforms store, manage, and expose data relevant to digital forensic investigations and data acquisition.
• Experience with specialized digital forensic domains, including network forensics (e.g., log analysis and data correlation), mobile device forensics, and Internet-of-Things (IoT) investigations involving the identification, acquisition, and analysis of data.
• Experience with case management systems, evidence management systems, quality control processes and systems used to support digital forensic investigations and laboratory operations.
• Ability to lead, collaborate within a team environment, and adapt to evolving investigative priorities, with high attention to detail, strong analytical skills, high ethical standards and professionalism, and excellent written and verbal communication skill.

Strongly Preferred Qualifications

• Certifications such as CFCE (IACIS), CCE, ENCE, GCFA, GNFA, Cellebrite certifications, or other relevant digital forensic certifications; foundational or advanced security certifications (e.g., CompTIA A+, Network+, Security+, CISSP) are also considered beneficial.
• Experience working in a structured digital forensics laboratory environment, including laboratory maintenance, validations, adherence to established policies, procedures, and standards, and participation in quality control processes (e.g., peer and technical review) to ensure defensible and repeatable forensic practices; familiarity with ANAB accreditation or similar frameworks is beneficial.
• Experience supporting internal, corporate, security or criminal investigations, and having the ability to compose clear, concise, and comprehensive technical documentation and digital forensic investigative reports tailored to a variety of audiences, and experience supporting or providing testimony in legal proceedings (e.g., depositions, hearings, or trials) in addition to working with subpoenas, warrants, or other legal processes.

Additional Requirements
It is the policy of Minnesota IT Services that a successful candidate must pass all legally required checks prior to employment which may consist of the following:

• SEMA4 Records Check (applies to current and past state employees only)
• Criminal History Check
• Reference Check
• Social Security and Address Verification
• Education Verification
• CJIS Background Check
• Other legally required checks

Minnesota IT Services does not participate in the federal E-Verify program. Minnesota IT Services is unable to sponsor applicants for work visas, including F-1 STEM OPT extensions, and cannot complete Form I-9 or any other documentation requiring employer participation in E-Verify. All applicants must be legally authorized to work in the United States at the time of application.
Application Details
How To Apply
Select "Apply for Job" at the top of this page. If you have questions about applying for jobs, contact the job information line at 651-259-3637 or email careers@state.mn.us . For additional information about the application process, go to http://www.mn.gov/careers .
Contact
If you have questions about this position, contact Human Resources at w orkwithmnit@state.mn.us .
Connect 700 Program
To receive consideration as a Connect 700 Program applicant, apply online, email the Job ID#, the Working Title and your valid Proof of Eligibility Certificate by the closing date to Human Resources at w orkwithmnit@state.mn.us .
Veterans
To be considered for any Veteran's Status , you MUST indicate this on your application.
RECENTLY SEPARATED VETERANS (RSV) : Effective July 1, 2009, legislation provides that the top five RSV applicants who apply and meet the qualifications for a vacancy shall be granted an interview. You must:

1. Meet all Minimum Qualifications identified in this posting.
2. Meet all of the RSV criteria.
3. Submit a copy of your DD-214 form by the closing date to: w orkwithmnit@state.mn.us

CERTAIN DISABLED VETERANS : Effective August 1, 2012, legislation provides state agencies with the option to appoint certain disabled veterans on a noncompetitive basis if you:

1. Meet service requirements and have a verified service-connected disability rating of at least 30%.
2. Provide qualifying documentation verifying the disability.
3. Meet all Minimum Qualifications identified in this posting.
4. You must submit all documentation by the closing date to: w orkwithmnit@state.mn.us

Current State Employees

• Bidders: This vacancy is open for bids and all qualified applicants simultaneously. This vacancy will be filled in accordance with appli