{
  "entityType": "role",
  "schemaVersion": "role.v1",
  "slug": "role-15-1299-06",
  "socCode": "15-1299.06",
  "title": "Digital Forensics Analysts",
  "summary": "Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.",
  "aliases": [
    "Cyber Analyst",
    "Cyber Defense Analyst",
    "Cyber Digital Forensics",
    "Cyber Digital Media Analyst",
    "Cyber Forensics Analyst",
    "Cyber Intelligence Analyst",
    "Cyber Threat Analyst",
    "Cyber Threat Hunter",
    "Cyber Threat Intelligence Analyst",
    "Cybersecurity Analyst (Cyber)",
    "Cybersecurity Engineer (Cyber)",
    "Cybersecurity Incident Response Analyst (Cyber)"
  ],
  "tasks": [
    {
      "text": "Adhere to legal policies and procedures related to handling digital media.",
      "type": "n/a",
      "iwa": "4.A.1.a.2.j"
    },
    {
      "text": "Analyze log files or other digital information to identify the perpetrators of network intrusions.",
      "type": "n/a",
      "iwa": "4.A.1.a.1.c"
    },
    {
      "text": "Conduct predictive or reactive analyses on security measures to support cyber security initiatives.",
      "type": "n/a",
      "iwa": "4.A.2.a.4.l"
    },
    {
      "text": "Create system images or capture network settings from information technology environments to preserve as evidence.",
      "type": "n/a",
      "iwa": "4.A.2.a.2.c"
    },
    {
      "text": "Develop plans for investigating alleged computer crimes, violations, or suspicious activity.",
      "type": "n/a",
      "iwa": "4.A.2.b.6.b"
    },
    {
      "text": "Develop policies or requirements for data collection, processing, or reporting.",
      "type": "n/a",
      "iwa": "4.A.2.b.2.l"
    },
    {
      "text": "Duplicate digital evidence to use for data recovery and analysis procedures.",
      "type": "n/a",
      "iwa": "4.A.3.b.6.e"
    },
    {
      "text": "Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.",
      "type": "n/a",
      "iwa": "4.A.2.b.1.h"
    },
    {
      "text": "Maintain cyber defense software or hardware to support responses to cyber incidents.",
      "type": "n/a",
      "iwa": "4.A.3.b.5.c"
    },
    {
      "text": "Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.",
      "type": "n/a",
      "iwa": "4.A.2.b.3.a"
    },
    {
      "text": "Perform file signature analysis to verify files on storage media or discover potential hidden files.",
      "type": "n/a",
      "iwa": "4.A.1.a.1.c"
    },
    {
      "text": "Perform forensic investigations of operating or file systems.",
      "type": "n/a",
      "iwa": "4.A.1.a.1.c"
    }
  ],
  "emergingTasks": [],
  "activities": [
    {
      "name": "Monitor the security of digital information.",
      "iwa": "4.A.1.a.2.j"
    },
    {
      "name": "Examine records or other types of data to investigate criminal activities.",
      "iwa": "4.A.1.a.1.c"
    },
    {
      "name": "Analyze security of systems, network, or data.",
      "iwa": "4.A.2.a.4.l"
    },
    {
      "name": "Compile technical information or documentation.",
      "iwa": "4.A.2.a.2.c"
    },
    {
      "name": "Plan production or operational procedures or sequences.",
      "iwa": "4.A.2.b.6.b"
    },
    {
      "name": "Establish operational policies.",
      "iwa": "4.A.2.b.2.l"
    },
    {
      "name": "Record images needed to address work issues.",
      "iwa": "4.A.3.b.6.e"
    },
    {
      "name": "Identify information technology project resource requirements.",
      "iwa": "4.A.2.b.1.h"
    },
    {
      "name": "Develop technical methods or processes.",
      "iwa": "4.A.3.b.2.f"
    },
    {
      "name": "Maintain computer equipment or software.",
      "iwa": "4.A.3.b.5.c"
    },
    {
      "name": "Maintain knowledge of laws or regulations.",
      "iwa": "4.A.2.b.3.a"
    },
    {
      "name": "Analyze traffic data.",
      "iwa": "4.A.2.a.4.g"
    },
    {
      "name": "Maintain records, documents, or other files.",
      "iwa": "4.A.3.b.6.h"
    },
    {
      "name": "Provide recommendations to others about computer hardware.",
      "iwa": "4.A.4.b.6.d"
    },
    {
      "name": "Recommend changes to improve computer or information systems.",
      "iwa": "4.A.4.b.6.d"
    },
    {
      "name": "Translate information for others.",
      "iwa": "4.A.4.a.1.c"
    },
    {
      "name": "Write computer programming code.",
      "iwa": "4.A.3.b.1.a"
    },
    {
      "name": "Enter codes or other information into computers.",
      "iwa": "4.A.3.b.1.f"
    },
    {
      "name": "Write reports or evaluations.",
      "iwa": "4.A.3.b.6.c"
    },
    {
      "name": "Testify at legal or legislative proceedings.",
      "iwa": "4.A.4.a.3.a"
    }
  ],
  "capabilities": [],
  "skills": [
    {
      "name": "Linux",
      "type": "Specialized Skill"
    },
    {
      "name": "Unix",
      "type": "Specialized Skill"
    },
    {
      "name": "ServiceNow",
      "type": "Specialized Skill"
    },
    {
      "name": "Microsoft Windows",
      "type": "Common Skill"
    },
    {
      "name": "Microsoft PowerPoint",
      "type": "Common Skill"
    },
    {
      "name": "Microsoft Excel",
      "type": "Common Skill"
    },
    {
      "name": "Microsoft Access",
      "type": "Specialized Skill"
    },
    {
      "name": "Kubernetes",
      "type": "Specialized Skill"
    },
    {
      "name": "Apple IOS",
      "type": "Specialized Skill"
    },
    {
      "name": "Wireshark",
      "type": "Specialized Skill"
    },
    {
      "name": "OpenVAS",
      "type": "Specialized Skill"
    },
    {
      "name": "Metasploit",
      "type": "Specialized Skill"
    },
    {
      "name": "Kali Linux",
      "type": "Specialized Skill"
    },
    {
      "name": "Presentation Software",
      "type": "Specialized Skill"
    }
  ],
  "tools": [
    {
      "example": "Amazon Web Services AWS software",
      "category": "Data base user interface and query software",
      "hot": true,
      "inDemand": true
    },
    {
      "example": "Linux",
      "category": "Operating system software",
      "hot": true,
      "inDemand": true
    },
    {
      "example": "Microsoft PowerShell",
      "category": "Development environment software",
      "hot": true,
      "inDemand": true
    },
    {
      "example": "Python",
      "category": "Object or component oriented development software",
      "hot": true,
      "inDemand": true
    },
    {
      "example": "Splunk Enterprise",
      "category": "Enterprise system management software",
      "hot": true,
      "inDemand": true
    },
    {
      "example": "Structured query language SQL",
      "category": "Data base user interface and query software",
      "hot": true,
      "inDemand": true
    },
    {
      "example": "Ansible software",
      "category": "Expert system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Apple iOS",
      "category": "Operating system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Apple macOS",
      "category": "Operating system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Bash",
      "category": "Operating system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Border Gateway Protocol BGP",
      "category": "Switch or router software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "C",
      "category": "Development environment software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "C#",
      "category": "Object or component oriented development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "C++",
      "category": "Object or component oriented development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Extensible markup language XML",
      "category": "Enterprise application integration software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Go",
      "category": "Development environment software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Google Workspace software",
      "category": "Office suite software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Hypertext markup language HTML",
      "category": "Web platform development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "IBM Terraform",
      "category": "Configuration management software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "JavaScript",
      "category": "Web platform development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Kubernetes",
      "category": "Application server software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Access",
      "category": "Data base user interface and query software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Active Directory",
      "category": "Internet directory services software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Azure software",
      "category": "Development environment software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Excel",
      "category": "Spreadsheet software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Office software",
      "category": "Office suite software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft PowerPoint",
      "category": "Presentation software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Windows",
      "category": "Operating system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Microsoft Windows Server",
      "category": "Operating system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Oracle Java",
      "category": "Object or component oriented development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Perl",
      "category": "Object or component oriented development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "PHP",
      "category": "Web platform development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "R",
      "category": "Object or component oriented development software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Ruby",
      "category": "Development environment software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "ServiceNow",
      "category": "Data base user interface and query software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Slack",
      "category": "Cloud-based data access and sharing software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "UNIX",
      "category": "Operating system software",
      "hot": true,
      "inDemand": false
    },
    {
      "example": "Firewall software",
      "category": "Network security and virtual private network VPN equipment software",
      "hot": false,
      "inDemand": true
    },
    {
      "example": "MITRE ATT&CK software",
      "category": "Program testing software",
      "hot": false,
      "inDemand": true
    },
    {
      "example": "AccessData FTK",
      "category": "Network monitoring software",
      "hot": false,
      "inDemand": false
    }
  ],
  "workContext": [],
  "preparation": {
    "jobZone": "4",
    "jobZoneName": "Job Zone Four: Considerable Preparation Needed",
    "education": "Most of these occupations require a four-year bachelor's degree, but some do not.",
    "experience": "A considerable amount of work-related skill, knowledge, or experience is needed for these occupations. For example, an accountant must complete four years of college and work for several years in accounting to be considered qualified.",
    "svpRange": "(7.0 to < 8.0)",
    "educationDistribution": []
  },
  "personFit": [
    {
      "name": "Dependability",
      "family": "work_style",
      "value": 7
    },
    {
      "name": "Information Technology",
      "family": "specific_interest_area",
      "value": 6.44
    },
    {
      "name": "Investigative",
      "family": "career_interest_type",
      "value": 6.11
    },
    {
      "name": "Conventional",
      "family": "career_interest_type",
      "value": 6.03
    },
    {
      "name": "Attention to Detail",
      "family": "work_style",
      "value": 6
    },
    {
      "name": "Integrity",
      "family": "work_style",
      "value": 5
    },
    {
      "name": "Protective Service",
      "family": "specific_interest_area",
      "value": 4.73
    },
    {
      "name": "Cautiousness",
      "family": "work_style",
      "value": 4
    },
    {
      "name": "Mathematics/Statistics",
      "family": "specific_interest_area",
      "value": 3.98
    },
    {
      "name": "Law",
      "family": "specific_interest_area",
      "value": 3.83
    },
    {
      "name": "Realistic",
      "family": "career_interest_type",
      "value": 3.2
    },
    {
      "name": "Intellectual Curiosity",
      "family": "work_style",
      "value": 3
    },
    {
      "name": "Enterprising",
      "family": "career_interest_type",
      "value": 2.71
    },
    {
      "name": "Engineering",
      "family": "specific_interest_area",
      "value": 2.47
    },
    {
      "name": "Mechanics/Electronics",
      "family": "specific_interest_area",
      "value": 2.29
    },
    {
      "name": "Office Work",
      "family": "specific_interest_area",
      "value": 2.18
    }
  ],
  "relatedRoles": [
    {
      "socCode": "15-1212.00",
      "slug": "role-15-1212-00",
      "title": "Information Security Analysts",
      "tier": "Primary-Short"
    },
    {
      "socCode": "15-1299.05",
      "slug": "role-15-1299-05",
      "title": "Information Security Engineers",
      "tier": "Primary-Short"
    },
    {
      "socCode": "33-3021.06",
      "slug": "role-33-3021-06",
      "title": "Intelligence Analysts",
      "tier": "Primary-Short"
    },
    {
      "socCode": "15-1299.04",
      "slug": "role-15-1299-04",
      "title": "Penetration Testers",
      "tier": "Primary-Short"
    },
    {
      "socCode": "13-1199.07",
      "slug": "role-13-1199-07",
      "title": "Security Management Specialists",
      "tier": "Primary-Short"
    },
    {
      "socCode": "11-3013.01",
      "slug": "role-11-3013-01",
      "title": "Security Managers",
      "tier": "Primary-Long"
    },
    {
      "socCode": "15-1211.00",
      "slug": "role-15-1211-00",
      "title": "Computer Systems Analysts",
      "tier": "Primary-Long"
    },
    {
      "socCode": "19-4092.00",
      "slug": "role-19-4092-00",
      "title": "Forensic Science Technicians",
      "tier": "Primary-Long"
    },
    {
      "socCode": "15-2051.01",
      "slug": "role-15-2051-01",
      "title": "Business Intelligence Analysts",
      "tier": "Primary-Long"
    },
    {
      "socCode": "15-1299.03",
      "slug": "role-15-1299-03",
      "title": "Document Management Specialists",
      "tier": "Primary-Long"
    },
    {
      "socCode": "15-1231.00",
      "slug": "role-15-1231-00",
      "title": "Computer Network Support Specialists",
      "tier": "Supplemental"
    },
    {
      "socCode": "11-3021.00",
      "slug": "role-11-3021-00",
      "title": "Computer and Information Systems Managers",
      "tier": "Supplemental"
    }
  ],
  "careerClusters": [
    {
      "cluster": "Digital Technology",
      "slug": "digital-technology"
    },
    {
      "cluster": "Public Service & Safety",
      "slug": "public-service-safety"
    }
  ],
  "educationLevel": {
    "category": "Bachelor's degree",
    "slug": "bachelor-s-degree"
  },
  "studyPrograms": [
    {
      "title": "Biological and Biomedical Sciences",
      "slug": "biological-and-biomedical-sciences"
    },
    {
      "title": "Computer and Information Sciences and Support Services",
      "slug": "computer-and-information-sciences-and-support-services"
    },
    {
      "title": "Health Professions and Related Programs",
      "slug": "health-professions-and-related-programs"
    },
    {
      "title": "Homeland Security, Law Enforcement, Firefighting and Related Protective Services",
      "slug": "homeland-security-law-enforcement-firefighting-and-related-protective-services"
    },
    {
      "title": "Multi/Interdisciplinary Studies",
      "slug": "multi-interdisciplinary-studies"
    },
    {
      "title": "Physical Sciences",
      "slug": "physical-sciences"
    }
  ],
  "market": {
    "medianWage": 108970,
    "meanWage": 116700,
    "pct10Wage": 52650,
    "pct25Wage": 76360,
    "pct75Wage": 147530,
    "pct90Wage": 176800,
    "employment": 439380,
    "areaTitle": "U.S."
  },
  "industries": {
    "top": [
      {
        "naics": "54",
        "slug": "54",
        "title": "Professional, Scientific, and Technical Services",
        "level": "Sector",
        "employment": 130160,
        "medianWage": 106200,
        "lq": 4.24
      },
      {
        "naics": "51",
        "slug": "51",
        "title": "Information",
        "level": "Sector",
        "employment": 43000,
        "medianWage": 126550,
        "lq": 5.19
      },
      {
        "naics": "52",
        "slug": "52",
        "title": "Finance and Insurance",
        "level": "Sector",
        "employment": 28690,
        "medianWage": 126080,
        "lq": 1.62
      },
      {
        "naics": "55",
        "slug": "55",
        "title": "Management of Companies and Enterprises",
        "level": "Sector",
        "employment": 25660,
        "medianWage": 127600,
        "lq": 3.21
      },
      {
        "naics": "56",
        "slug": "56",
        "title": "Administrative and Support and Waste Management and Remediation Services",
        "level": "Sector",
        "employment": 24880,
        "medianWage": 96000,
        "lq": 0.97
      },
      {
        "naics": "31-33",
        "slug": "31-33",
        "title": "Manufacturing",
        "level": "Sector",
        "employment": 21020,
        "medianWage": 102950,
        "lq": 0.58
      },
      {
        "naics": "61",
        "slug": "61",
        "title": "Educational Services",
        "level": "Sector",
        "employment": 18100,
        "medianWage": 79900,
        "lq": 0.47
      },
      {
        "naics": "561320",
        "slug": "561320",
        "title": "Temporary Help Services",
        "level": "National industry",
        "employment": 13460,
        "medianWage": 95780,
        "lq": 1.78
      },
      {
        "naics": "42",
        "slug": "42",
        "title": "Wholesale Trade",
        "level": "Sector",
        "employment": 13130,
        "medianWage": 100550,
        "lq": 0.76
      },
      {
        "naics": "62",
        "slug": "62",
        "title": "Health Care and Social Assistance",
        "level": "Sector",
        "employment": 11030,
        "medianWage": 83320,
        "lq": 0.17
      },
      {
        "naics": "541330",
        "slug": "541330",
        "title": "Engineering Services",
        "level": "National industry",
        "employment": 9590,
        "medianWage": 108370,
        "lq": 2.91
      },
      {
        "naics": "48-49",
        "slug": "48-49",
        "title": "Transportation and Warehousing",
        "level": "Sector",
        "employment": 7000,
        "medianWage": 65350,
        "lq": 0.33
      }
    ],
    "concentrated": [
      {
        "naics": "541720",
        "slug": "541720",
        "title": "Research and Development in the Social Sciences and Humanities",
        "level": "National industry",
        "employment": 1240,
        "lq": 7.16
      },
      {
        "naics": "51",
        "slug": "51",
        "title": "Information",
        "level": "Sector",
        "employment": 43000,
        "lq": 5.19
      },
      {
        "naics": "54",
        "slug": "54",
        "title": "Professional, Scientific, and Technical Services",
        "level": "Sector",
        "employment": 130160,
        "lq": 4.24
      },
      {
        "naics": "55",
        "slug": "55",
        "title": "Management of Companies and Enterprises",
        "level": "Sector",
        "employment": 25660,
        "lq": 3.21
      },
      {
        "naics": "524114",
        "slug": "524114",
        "title": "Direct Health and Medical Insurance Carriers",
        "level": "National industry",
        "employment": 3860,
        "lq": 3.02
      },
      {
        "naics": "541330",
        "slug": "541330",
        "title": "Engineering Services",
        "level": "National industry",
        "employment": 9590,
        "lq": 2.91
      },
      {
        "naics": "561320",
        "slug": "561320",
        "title": "Temporary Help Services",
        "level": "National industry",
        "employment": 13460,
        "lq": 1.78
      },
      {
        "naics": "52",
        "slug": "52",
        "title": "Finance and Insurance",
        "level": "Sector",
        "employment": 28690,
        "lq": 1.62
      }
    ],
    "count": 51
  },
  "aiSignals": [],
  "aiOutlook": {
    "index": {
      "value": 92,
      "percentile": 97,
      "band": "High",
      "version": "ai-exposure-index-v1",
      "components": [
        {
          "percentile": 95,
          "source": "openai_gpts_are_gpts"
        },
        {
          "percentile": 88,
          "source": "microsoft_working_with_ai"
        }
      ],
      "componentCount": 2
    },
    "exposure": [
      {
        "source": "eloundou_gamma",
        "label": "LLM task exposure, γ (OpenAI / Eloundou)",
        "value": 1,
        "percentile": 95,
        "band": "High",
        "note": "Share of this job's tasks where a large language model plus simple tools could cut the time to do them by at least half. γ is capped at 1.0 and many jobs reach that ceiling, so treat a top score as 'in the top group', not a precise rank."
      },
      {
        "source": "microsoft_applicability",
        "label": "AI assistant applicability (Microsoft)",
        "value": 0.29778584910303174,
        "percentile": 88,
        "band": "High",
        "note": "How applicable today's AI assistants are to this job's activities, measured from real Microsoft Copilot conversations. Applicability is not the same as replacement."
      }
    ],
    "eloundou": {
      "alpha": 0.45,
      "beta": 0.7250000000000001,
      "gamma": 1
    },
    "usageTasks": [],
    "bls": {
      "growthPercent": 8.2,
      "growthPercentile": 88,
      "direction": "Growing fast",
      "annualOpeningsThousands": 31.3,
      "annualOpeningsPercentile": 84,
      "employment2024Thousands": 472,
      "employment2034Thousands": 510.5
    },
    "sources": [
      {
        "source": "bls_employment_projections",
        "version": "2024-2034"
      },
      {
        "source": "microsoft_working_with_ai",
        "version": "working-with-ai"
      },
      {
        "source": "openai_gpts_are_gpts",
        "version": "gpts-are-gpts"
      }
    ]
  },
  "counts": {
    "tasks": 20,
    "skills": 14,
    "capabilities": 0,
    "tools": 64,
    "relatedRoles": 20
  },
  "source": {
    "dataset": "gold.onet_role_starter_surface",
    "version": "30.3",
    "generatedAt": "2026-06-02T21:00:32.945303+00:00",
    "contentHash": "0333262d833f9205"
  }
}