Digital Forensics Analysts

Information TechnologyO*NET 15-1299.06United States

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation.

COMING SOON See related ASU learning

Median annual earnings: $113,638
Projected change: +11.4%
Typical education: Bachelor's degree
Employment: 499.03K jobs

Explore this career by location

Compare nationwide estimates with state or county job-market data.

Showing United States

State

County

Loading available locations…

Build the skills

ASU learning related to this career

These courses and certificates are connected through catalog career relationships and Lightcast skill tags.

The work

What digital forensics analysts do

Tasks reported for this occupation, ordered by how often they come up in the role.

Adhere to legal policies and procedures related to handling digital media.
Analyze log files or other digital information to identify the perpetrators of network intrusions.
Conduct predictive or reactive analyses on security measures to support cyber security initiatives.
Create system images or capture network settings from information technology environments to preserve as evidence.
Develop plans for investigating alleged computer crimes, violations, or suspicious activity.
Develop policies or requirements for data collection, processing, or reporting.
Duplicate digital evidence to use for data recovery and analysis procedures.
Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.
Maintain cyber defense software or hardware to support responses to cyber incidents.
Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.
Perform file signature analysis to verify files on storage media or discover potential hidden files.
Perform forensic investigations of operating or file systems.
Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.
Preserve and maintain digital forensic evidence for analysis.
Recommend cyber defense software or hardware to support responses to cyber incidents.
Recover data or decrypt seized data.
Write and execute scripts to automate tasks, such as parsing large data files.
Write cyber defense recommendations, reports, or white papers using research or experience.
Write reports, sign affidavits, or give depositions for legal proceedings.
Write technical summaries to report findings.

Pay and outlook

What the job pays and where it is heading

Annual earnings range

Reported earnings by percentile, United States

10th percentile: $53,796
25th percentile: $76,983
50th percentile: $113,638
75th percentile: $155,092
90th percentile: $191,936

The gold marker shows the median. Half earn more than $113,638 and half earn less.

Employment outlook

2025 to 2035 projection

+11.4%faster than average

2025499,030 jobs

2035 projected555,787 jobs

56,757 more positions over the decade, before replacement hiring.

Preparation

Education levels

What people currently working in the career hold. These are not entry requirements.

Bachelor's degree: 75.2%
Associate degree: 12.9%
Certificate: 7.2%
Master's or Professional degree: 2.8%
Some college: 2%

Skills

Skills employers ask for

Technical skills appearing most often in job postings for this occupation.

Cyber Threat Intelligence
Cyber Security
Incident Response
Cyber Threat Hunting
MITRE ATT&CK Framework
Computer Science
Python (Programming Language)
Security Information And Event Management (SIEM)
Digital Forensics
Intelligence Analysis
Automation
Workflow Management
Threat Detection
Scripting
Malware Analysis
Open Source Intelligence
Vulnerability Management
Splunk
Artificial Intelligence
Cyber Operations

How the work gets done

Core competencies

Broad capabilities associated with strong performance in this occupation.

In the market

Job titles and employers

Recent job postings in United States

Common job titles

01Cyber Threat Intelligence Analysts565 postings
02Cyber Threat Analysts410 postings
03Threat Intelligence Analysts215 postings
04Threat Analysts133 postings
05Insider Threat Analysts132 postings
06Threat Researchers80 postings
07Cyber Intelligence Analysts61 postings
08Digital Forensic Investigators56 postings
09Directors of Innovation52 postings
10Cyber Analysts47 postings
11Cybersecurity Specialists47 postings
12Product Champions39 postings
13Intelligence Analysts32 postings
14Malware Analysts32 postings
15Cyber Defense Analysts31 postings
16Cyber Threat Hunters28 postings
17Digital Forensics Analysts27 postings
18Security Analysts26 postings
19Intrusion Analysts21 postings
20Cybersecurity Analysts20 postings

Top employers

01Capital One112 postings
02Lumen Technologies105 postings
03Leidos67 postings
04GovCIO64 postings
05Accenture63 postings
06Peraton62 postings
07CrowdStrike54 postings
08Shi International Ltd52 postings
09Amazon45 postings
10Federal Bureau of Investigation42 postings
11Humana42 postings
12MITRE Corporation41 postings
13Booz Allen Hamilton34 postings
14Palo Alto Networks34 postings
15Providence33 postings
16Bank of America29 postings
17ManTech22 postings
18Microsoft21 postings
19Huntington Ingalls Industries20 postings
20Google18 postings

Keep looking

Blockchain Engineers

Median pay: $113,638
Employment outlook: +11.4%

Computer and Information Research Scientists

Median pay: $140,296
Employment outlook: +20%

Computer and Information Systems Managers

Median pay: $174,134
Employment outlook: +17.3%

Computer Hardware Engineers

Median pay: $160,653
Employment outlook: +9.4%