Location: Linthicum Heights, MD
Security Clearance: Active TS/SCI [Required]
Job Type: Full-Time

Target Salary Range*: $100,000 - $140,000

*This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

Position Overview

The Cryptologist supports a Department of Defense (DoD) customer as part of a technical team focused on cyber investigations, digital forensics, cyber threat analysis, and mission support. The role specializes in data recovery and device access to support law enforcement, counterintelligence (CI) investigations, and digital forensic examiners, including the recovery of encrypted, deleted, and otherwise inaccessible data from seized devices and digital media.

Key Responsibilities

Data Recovery and Device Access

• Decrypt encrypted data from mobile devices, computers, and storage media.
• Recover deleted data not recognized by standard carving tools.
• Extract data from flash memory chips with custom or proprietary file systems.
• Support evidence recovery from locked or damaged devices in collaboration with digital forensic examiners.

Research and Analysis

• Research encryption implementations and storage architectures used in consumer and commercial devices to identify recovery pathways.

Technical Documentation

• Produce detailed technical reports documenting methodologies and findings suitable for federal court proceedings or intelligence products.

Qualifications

Education

• BS/BA with a minimum of 8 years of experience [Required].
• MS/MA with a minimum of 6 years of experience [Required].
• PhD with a minimum of 3 years of experience [Required].
• An additional four years of experience may be considered in lieu of a BS/BA degree [Required].
• A degree in Mathematics, Computer Science, Cryptography, Information Security, or a related field is highly desired.

Experience

• Experience decrypting data from encrypted mobile devices (Android/iOS), full-disk encryption (FDE), and file/container-level encryption schemes [Required].
• Experience recovering deleted or fragmented data beyond the capabilities of standard forensic carving tools [Required].
• Experience extracting data from NAND/NOR flash memory chips, including devices with custom or proprietary file systems [Required].
• Experience supporting law enforcement, CI, or federal investigative operations [Required].

Skills

• Strong programming and scripting proficiency in Python, C++, Java, or similar languages [Required].
• Familiarity with digital forensic tools and workflows, including Cellebrite, GrayKey, Magnet AXIOM, EnCase, FTK, and X-Ways [Required].
• Low-level knowledge of common file systems, including FAT, NTFS, EXT2/3/4, APFS, and proprietary embedded file systems [Required].

Clearance

• Active TS clearance/SCI eligible [Required].

Preferred Qualifications

Experience

• Experience with hardware-based data recovery techniques, including JTAG, chip-off, and ISP (In-System Programming).
• Background in reverse engineering storage protocols, firmware, or encryption implementations on embedded devices.
• Familiarity with legal frameworks governing lawful access and chain-of-custody requirements for recovered data.
• Prior experience supporting DoD, Intelligence Community (IC), or federal law enforcement customers, including FBI, DEA, HSI, and NCIS.
• Experience testifying as an expert witness or providing technical declarations in federal proceedings.

Education

• A degree in Mathematics, Computer Science, Cryptography, Information Security, or a related field.