Principal Digital Forensic Investigator

At Apple, world-class security begins with protecting the ideas, inventions, and products that define our brand. Join Global Security Investigations (GSI), an innovative, multidisciplinary team of investigators, legal counsel, technical analysts and forensic experts investigating risks to Apple’s intellectual property, trade secrets, and confidential information.

In this role as a Principal Digital Forensic Investigator, you will serve as both a senior technical authority and trusted advisor to executive and legal team and you will craft investigative strategies to address some of Apple’s most critical legal matters. You will lead high-consequence forensic investigations into insider threats, data theft, media leaks, cybercrime, complex frauds and a variety of other concerns. The successful candidate will develop bespoke forensics solutions to address the rapidly changing world of forensics, foster strong partnerships across Apple’s businesses, identify security loopholes and develop risk remediations.

Principal-level career experience (25+ years) leading complex digital forensic investigations for law enforcement (federal/state/local/international) and in the private sector. Extensive experience performing digital forensics for high-tech crimes, including: trade secret misappropriation, insider threats, data exfiltration, media leaks, cyber incidents, internal fraud and national-security-grade matters. Demonstrated expertise in developing bespoke data acquisition and digital forensic solutions. Scripting proficiency in Python and Bash. Mastery of Apple operating systems (macOS, iOS, iPadOS, WatchOS) and corresponding core artifacts (e.g., Plists, SQLite databases, file system structures), as well as cloud forensics (iCloud, AWS, GCP). Prior qualification as an expert witness in state, federal, or international courts, specifically regarding Apple forensics and digital evidence integrity. Extensive testimonial experience in civil and/or criminal legal proceedings. Prior experience developing and delivering trainings on MacOS forensics to law enforcement and the private sector. Deep knowledge of secure handling and storage for physical and electronic evidence in alignment with criminal/civil chain of custody procedures and industry best practices. Prior employment as police officer, investigator or equivalent with US or international law enforcement agency. Extensive experience interviewing witnesses and subjects of investigation. Strong background eDiscovery collections, processing and data review tools. Certification in DFIR, SANS, and/or relevant industry education. Ability to deliver accurate, impartial findings with consistent attention to detail. Strong verbal and written communication. Commitment to integrity and confidentiality.

Experience working with Fortune 500 companies. Degree in Computer Science, Digital Forensics, Information Systems or equivalent.