TXCC - Digital Forensics Laboratory Director (Director IV)

The Texas Cyber Command (TXCC) is the state's front line of cyber defense, established by the 89th Texas Legislature to protect Texans, critical infrastructure, and government systems from evolving cyber threats. Headquartered in San Antonio (a national hub of cybersecurity talent), TXCC unites threat detection, incident response, and statewide cyber readiness under one mission-driven agency to establish Texas as the most cyber-resilient state in the nation.

At TXCC, your work doesn't just sit in a queue - it actively secures, protects, defends, and educates over 31 million Texans every day.

The Director of the Digital Forensics Laboratory is a senior technical mission leader responsible for TXCC digital forensic operations, evidence preservation, custody, forensic analysis, forensic quality, scope of harm support, incident forensics, and law enforcement handoff support. This role is focused on reducing Time to Action by producing forensic truth that helps CIRU contain, eradicate, recover, and understand cyber incidents while preserving evidence quality and supporting future investigative, legal, intelligence, and remediation needs.

This role is a senior mission leadership position, not a narrow technical manager role. The Director leads technical execution while maintaining readiness, service visibility, mission risk awareness, and practical support to the UCTF Director and the TXCC Deputy Chief. The role strengthens TXCC mission assurance by producing forensic truth at operational speed while preserving evidence quality, privacy discipline, investigative usefulness, and confidence in scope of harm findings.

The DFL is designed as an incident support forensic capability, not a standalone law enforcement laboratory. It provides evidence grade preservation and analysis that can support operational response, intelligence reuse, law enforcement handoff, regulatory or audit support, and durable statewide improvement. This position performs highly advanced managerial and technical work involving digital forensics, evidence operations, forensic workflow design, quality management, secure laboratory operations, automation, partner support, and incident support.

Works under minimal supervision, with extensive latitude for initiative and independent judgment.

Leads DFL operations for evidence preservation, custody, forensic analysis, forensic quality, scope of harm assessment, incident forensics, and law enforcement export support. Builds and maintains DFL service posture for active incident response support, partner submitted evidence analysis, threat hunting tooling support, scope of harm analysis, cause analysis, regulatory or audit support, and law enforcement handoff support.

Maintains evidence quality through documented custody, hashing, acquisition notes, evidence manifests, repeatable workflows, tool validation, peer review, and defensible reporting practices. Supports CIRU incident operations by producing forensic findings, timelines, artifact analysis, scope assertions, malware or payload analysis, and containment or recovery support outputs.

Maintains visibility into forensic mission risk, including evidence handling constraints, custody gaps, analysis backlog, surge capacity, tool validation concerns, sensitive data handling issues, law enforcement handoff posture, and scope of harm uncertainty. Provides UCTF Director and the Deputy Chief with clear forensic readiness, evidence quality, active case load, scope of harm, analysis backlog, and incident support risk information when forensic conditions affect operational tempo or public service restoration.

Coordinates with SOC Platform and Shared Services to support forensic tooling, secure data flows, telemetry correlation, automation, evidence workflow integration, and platform reliability. Coordinates with CTIC to provide victim safe derived intelligence, indicators, artifact context, campaign observations, and sanitized findings for broader defensive action when appropriate.

Coordinates with Mission Control to maintain visibility of DFL service posture, active case load, surge status, blockers, resource needs, and items requiring command attention. Supports law enforcement collaboration and handoff when required, including export package preparation, evidence package quality, secure transfer support, and continuity of contact.

Develops and maintains forensic workflows for remote triage, full imaging, memory capture, automated pipeline processing, artifact enrichment, timeline generation, malware triage, and report production. Build DFL readiness for surge operations, twenty-four-hour incident support posture, secure enclave operations, equipment readiness, field collection kits, and partner collection integration.

Ensures significant incidents and forensic findings produce practical improvements to detections, playbooks, evidence procedures, training, partner guidance, operational profiles, and statewide protective action. Adapts and embodies TXCC culture of trust, transparency, disciplined initiative, and technical excellence.

There is room for error in execution, but none for confusion or ethical lapses. Performs other work-related duties as assigned.

All TXCC employees must: Be a United States citizen; and Complete and pass a fingerprint criminal background check.

Education

Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, public administration, emergency management, homeland security, business administration, or a related field. Experience: Minimum of eight (8) years of progressively responsible experience in digital forensics, incident response forensics, malware or payload analysis, evidence handling, forensic laboratory operations, cyber investigations support, secure analysis environments, or related cyber operations.

Minimum of five (5) years of supervisory, technical lead, forensic lead, laboratory lead, mission lead, or program lead experience involving technical professionals. Experience conducting forensic acquisition and analysis, including chain of custody, disk or file analysis, memory analysis, endpoint artifacts, timeline reconstruction, malware or payload triage, and scope-of-harm assessment.

Experience using or administering forensic technologies and supporting infrastructure, including forensic or malware analysis tools, evidence and case management systems, endpoint and log data sources, automation pipelines, and secure analysis environments. Experience establishing or applying forensic operating procedures and quality controls, including tool validation, peer review, evidence handling controls, and evidence export or transfer practices.

Experience communicating forensic findings and operational considerations to technical and executive audiences, including evidence-quality concerns, analysis backlogs, privacy considerations, scope-of-harm uncertainty, and law enforcement coordination. Licensure: Must obtain and maintain any required security clearances and satisfy applicable state employment requirements.

Acceptable Substitutions Additional related work experience may be used to substitute the formal education requirement on a year-for-year basis. Candidates must possess a high school diploma or equivalent certificate.

Experience: Experience leading a digital forensics laboratory, incident response forensics team, cyber investigations support function, malware analysis team, or comparable technical capability. Experience supporting cyber operations across government, higher education, critical infrastructure, law enforcement, emergency management, military, intelligence, or federal partner environments.

Experience designing, operating, or overseeing high-assurance forensic environments, including secure enclaves, isolated malware analysis environments, immutable or tamper-evident evidence storage, and sensitive data handling controls. Experience supporting complex evidentiary or external partner requirements, including law enforcement coordination, regulatory or audit matters, expert reporting, evidence transfer packages, or analysis of partner-submitted evidence.

Experience designing or implementing automated forensic workflows, including case orchestration, API-based tool integration, data enrichment, automated malware triage, timeline generation, or graph-based correlation. Experience establishing or maturing forensic laboratory quality and readiness programs, including examiner qualification or training standards, technical review frameworks, peer review practices, and laboratory readiness assessments.

Licensure: Professional certifications such as CISSP, CISM, GCFA, GCFE, GNFA, GREM, GCFR, EnCE, CFCE, CCE, GCIH, incident command credentials, or equivalent professional qualifications.

Knowledge of digital forensics, evidence preservation, chain of custody, acquisition methods, artifact analysis, timeline analysis, memory analysis, malware triage, and scope of harm assessment. Knowledge of incident response forensics, cyber investigations support, law enforcement handoff, privacy handling, secure data handling, and forensic reporting.

Knowledge of forensic quality practices, tool validation, repeatability, reproducibility, peer review, evidence storage, audit support, forensic readiness, and analysis backlog management. Skill in leading forensic operations under incident pressure while preserving evidence quality and operational usefulness. Skill in converting forensic findings into actionable support for containment, eradication, recovery, intelligence, and broader defensive improvement.

Skill in coordinating across CIRU, SOC, CTIC, Mission Control, law enforcement partners, affected entities, vendors, and augmentation teams. Skill in developing forensic procedures, service models, laboratory workflows, surge posture, and reporting practices. Skill in the use of computers and applicable software necessary to perform work assignments, such as word processing, spreadsheets, collaboration tools, presentation tools, case tracking tools, ticketing tools, dashboards, and Microsoft Office applications.

Skill in using forensic tools, evidence management systems, operational reporting tools, project tracking tools, service management tools, dashboard platforms, or collaboration platforms. Ability to balance speed, forensic quality, privacy, evidentiary discipline, operational usefulness, and partner needs during active incident support.

Ability to lead, coach, and develop technical staff in a high-tempo forensic environment. Ability to protect sensitive information, evidence, investigative details, and need-to-know boundaries. Ability to exercise sound judgment when forensic findings are incomplete, time-sensitive, technically complex, or operationally significant.

Ability to manage multiple cases, priorities, deadlines, and incident-support needs simultaneously. Ability to work independently and collaboratively in a mission-focused environment.

Frequent use of computers, forensic tools, evidence management systems, copiers, printers, telephones, collaboration platforms, and operational dashboards. Frequent standing, walking, sitting, listening, and talking. Frequent work under stress, as a team member, and in direct contact with others. Frequent work with time-sensitive operational, forensic, and sensitive information.

Frequent work requiring attention to detail, documentation accuracy, and confidentiality. Occasional handling, movement, or storage of digital evidence, forensic equipment, or field collection kits. Occasional bending, stooping, lifting, and climbing. Occasional travel may be required. May require extended or flexible work hours during cyber incidents, exercises, degraded operations, continuity events, surge operations, or statewide response activities.

Military Occupation Specialty Code The Military Occupation Specialty Codes applicable to this position can be found at this link . Selective Service Registration Section 651.005 of the Government Code requires males, ages 18 through 25 years, to provide proof of their Selective Service registration or proof of their exemption from the requirement as a condition of state employment.

H-1B Visa Sponsorship We are unable to sponsor or take over sponsorship of an employment visa. Texas Cyber Command employees must be a citizen of the United States. Equal Opportunity Employer Texas Cyber Command does not exclude anyone from consideration for recruitment, selection, appointment, training, promotion, retention, or any other personnel action, or deny any benefits or participation in programs or activities, which it sponsors on the grounds of race, color, national origin, sex, religion, age, or disability.

Please call 512-463-5920 to request reasonable accommodation.

Application Requirements Every application must reflect a full employment history for each job held. You may provide this either directly in the Work History section of your application or as an attached résumé, but either way, each position listed must include: Job title Name of employer Employment start and end dates (month and year) A summary of the duties and responsibilities you held If a listed position was part-time, please note that in the work history section or on your résumé.

Applicants must also answer the supplemental questions in the job application. Applications missing this information may be treated as incomplete and will not move forward in the review process. Additional Application Information Fields that don't apply to you should be marked "N/A." If you're relying on education (rather than experience) to meet the minimum qualifications for this position, please attach a copy of your college transcript to your application.

Leaving out required information could result in your application being disqualified from consideration. Applying Through Work In Texas (WIT) If you're applying via Work In Texas, you'll also need to complete the set of supplemental questions before your application can be considered. These questions are only in CAPPS Recruit, so you'll need to register for or sign in to your candidate profile: Access CAPPS Candidate Gateway Need some help putting together a résumé?

Work In Texas offers a "Create a Résumé" tool for job seekers on their website .

If you have any questions, please reach out to TXCC Human Resources at [email protected] .