Cyber Crime Investigator

• 402AAnalyze computer-generated threats for counter intelligence or criminal activity.Core
• 429AGather and preserve evidence used on the prosecution of computer crimes.Core
• 447AConduct analysis of log files, evidence, and other information in order to determine best methods for identifying the perpetrator(s) of a network intrusion or other crimes.Core
• 454Conduct interviews of victims and witnesses and conduct interviews or interrogations of suspects.Additional
• 507ADetermine and develop leads and identify sources of information in order to identify and/or prosecute the responsible parties to an intrusion or other crimes.Additional
• 512Develop a plan to investigate alleged crime, violation, or suspicious activity utilizing computers and the internet.Additional
• 564ADocument original condition of digital and/or associated evidence (e.g., via digital photographs, written reports, hash function checking).Additional
• 597Establish relationships, if applicable, between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies, vendors, and public relations professionals).Additional
• 613Examine recovered data for information of relevance to the issue at hand.Core
• 620AEmploy information technology (IT) systems and digital storage media to solve, investigate, and/or prosecute cybercrimes and fraud committed against people and property.Additional
• 623Fuse computer network attack analyses with criminal and counterintelligence investigations and operations.Additional
• 633Identify and/or determine whether a security incident is indicative of a violation of law that requires specific legal action.Additional
• 635Identify data or intelligence of evidentiary value to support counterintelligence and criminal investigations.Core
• 636Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration.Additional
• 637Identify elements of proof of the crime.Core
• 649Identify, collect, and seize documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents, investigations, and operations.Additional
• 788APrepare reports to document the investigation following legal standards and requirements.Additional
• 843Secure the electronic device or information source.Additional
• 871Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.Core
• 5040Analyze the crisis situation to ensure public, personal, and resource protection.Additional
• 5070Assess the behavior of the individual victim, witness, or suspect as it relates to the investigation.Additional
• 5210Determine the extent of threats and recommend courses of action and countermeasures to mitigate risks.Additional
• 5580Provide criminal investigative support to trial counsel during the judicial process.Additional

• 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
• 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Additional
• 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
• 281Knowledge of electronic devices (e.g., computer systems/components, access control devices, digital cameras, electronic organizers, hard drives, memory cards, modems, network components, printers, removable storage devices, scanners, telephones, copiers, credit card skimmers, facsimile machines, global positioning systems [GPSs]).Core
• 290Knowledge of processes for seizing and preserving digital evidence (e.g., chain of custody).Core
• 310Knowledge of legal governance related to admissibility (e.g., Federal Rules of Evidence).Additional
• 340Knowledge of types and collection of persistent data.Core
• 917Knowledge of social dynamics of computer attackers in a global context.Additional
• 1036Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.Core
• 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
• 1158* Knowledge of cybersecurity principles.Core
• 1159* Knowledge of cyber threats and vulnerabilities.Core
• 3480Knowledge of security implications of software configurations.Additional
• 6230Knowledge of crisis management protocols, processes, and techniques.Additional
• 6370Knowledge of physical and physiological behaviors that may indicate suspicious or abnormal activity.Additional
• 6440Knowledge of the judicial process, including the presentation of facts and evidence.Additional
• 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
• 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
• 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
• 7111* Knowledge of Zero Trust Security Model Principles.Core

• 217Skill in preserving evidence integrity according to standard operating procedures or national standards.Core
• 369Skill in collecting, processing, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.Core
• 383Skill in using scientific rules and methods to solve problems.Additional
• 1039Skill in evaluating the trustworthiness of the supplier and/or product.Additional

The DCWF Tool lists no abilities for this work role.