Specialist – Forensic Examiner – Digital Forensics, Digital Support Unit (AD6) - (job not limited to law enforcement candidates)

ORGANISATIONAL CONTEXT

This requires close cooperation with the Liaison Bureaux at Europol and via them with the Operational Teams in the MS.

EC3 also provides support to the EU institutions and MS in building operational and analytical capacity for investigations and cooperation with external partners. EC3 is the collective voice of European cybercrime investigators across law enforcement and the knowledge hub of law enforcement on how to tackle Cybercrime.

The Digital Support Unit is assisting EC3 Operations and other Operations Centres of Europol horizontally with intelligence products, information and forensic examination through two teams: Cyber Intelligence Team (CIT) and Forensic Support Team (FST).

CIT provides support in the pre-processing, enrichment and analysis of large amounts of operational data as well as specialised support in the fields of cyber threat Intelligence and cryptocurrency analysis. CIT liaises with the cybersecurity community and coordinates EU LE Emergency Response Protocol against major cross-border cyber-attacks.

FST provides decryption and digital forensic services, takes part in research and development activities supporting investigations and operations and also provides document forensic services.

FUNCTIONS AND DUTIES

The Specialist – Forensic Examiner (Digital Forensics) will be carrying out digital forensic examinations of seized exhibits in-house at Europol and during deployments on-the-spot at EU Member states and third countries with operational agreements, by extracting data, compiling forensic reports, performing exhibit registration activities and well as performing research and development activities in cooperation with other team members.

The incumbent carries out the following main functions and duties:

• Provide specialised knowledge and technical/forensic ‘on the spot’ support in the area of responsibility;
• Testify the results of forensic examinations during judicial proceedings;
• Liaise with the competent authorities in the EU MS, EU bodies, third countries and organisations in the field of digital forensics;
• Support projects of the unit, prepare and organise meetings, training courses and conferences and represent Europol at specialised conferences on European and international level;
• Draft documents and reports independently and in co-operation with other units and support business planning processes;
• Contribute to the development of methods, techniques and tools used by Europol and keep up to date with developments of forensic services/digital forensics;
• Insert, retrieve and monitor information within relevant systems;
• Support projects of the Team (such as R&D initiatives of forensic extraction methods, support implementation of ICT Projects and monitoring EU Funded Projects…);
• Perform any other duties in the area of competence as assigned by line management.

REQUIREMENTS - ELIGIBILITY AND SELECTION CRITERIA

1. Candidates must

• Be a national of one of the Member States of the European Union and enjoy full rights as a citizen;
• Have fulfilled any obligations imposed by the applicable laws on military service;
• Produce appropriate character references as to his or her suitability for the performance of the duties;
• Be physically fit to perform the duties pertaining to the post as further specified in Article 13 of the Conditions of Employment of Other Servants of the European Union (CEOS);
• Produce evidence of a thorough knowledge of one of the languages of the Union and a satisfactory knowledge of another language of the Union to the extent necessary for the performance of the duties.

1. Candidates must have

• A level of education which corresponds to completed university studies of at least three years attested by a diploma;

• Professional training of an equivalent level in a relevant area (e.g. Police Officer’s School) and after having completed the training, at least the number of years of relevant professional experience as indicated below:

• In addition to the above at least 3 years of total professional work experience gained after the award of the diploma.

1. Professional experience

Essential:

• Experience in digital forensics and network forensics;
• Experience in reverse engineering of applications and firmware of devices;
• Experience in providing digital forensic support on the spot or performing cyber-incident response;
• Experience in research and development in the area of digital forensics and/or IT security;

Desirable:

• Experience in investigating encrypted communication networks;
• Practical experience in lawful interception of communications.

1. Professional knowledge

Essential:

• In depth knowledge of digital forensic investigation and examination techniques used in a lab environment and during the on-the-spot deployments;
• In depth knowledge of network forensics, traffic data analysis, network stack, TCP/IP protocols;
• Knowledge of reverse engineering techniques of desktop and mobile applications and firmware of network and Io T devices;
• Intermediate programming skills in Python and/or C language.

1. General competencies

Communicating:

• Very good communication skills in English, both orally and in writing;
• Ability to draft clear and concise documents on complex matters for various audiences.

Analysing & problem solving:

• Keen eye for detail with the ability to maintain standards of accuracy under pressure of tight deadlines;
• Excellent analytical and critical thinking skills;
• Competent user of Microsoft Office applications (MS Word, Excel, Power Point and Outlook) and the internet.

Delivering quality and results:

• High degree of commitment and flexibility;
• High level of customer and service-orientation.

Prioritising and organising:

• Good administrative and organisational skills.

Resilience:

• Very good interpersonal skills, with the ability to work well, both independently and in a team.
• Ability to remain effective under a heavy workload and demonstrate resistance to stress.

Living diversity:

• Ability to work effectively in an international and multi-cultural environment.

1. Additional conditions:

Fulfil the condition stipulated in Article 5 of the Decision of the Executive Director on the Duration of contracts of employment for Temporary Agents, on the start date of the possible contract of employment which may be offered.

SELECTION PROCEDURE

The Authority Authorised to Conclude Contracts of Employment (AACC) sets up a Selection Committee, composed of at least three members, consisting of one chair and at least one member from the administration and one member designated by the Staff Committee.

For restricted posts (including restricted - Annex II posts), the AACC designates up to two additional members of the Selection Committee if so requested by the Chairperson of the Management Board. The additional members shall consist of a representative of the Presidency of the Council of the European Union or one representative of the Presidency and one representative of another Member State.

Certain selection criteria will be assessed only for shortlisted candidates during a written) test and/or a competency-based interview.

In case of candidates shortlisted for restricted posts (including restricted - Annex II posts), who had indicated membership of a competent authority in one of the Member States, Europol will seek confirmation from the relevant Europol National Unit to ensure that those candidates indeed belong to a competent authority.

The Selection Committee will shortlist the 10 highest scoring candidates. All candidates having a score equal to the 10th highest scoring candidate will be invited to take part in the selection procedure. At shortlisting stage, the Selection Committee will establish the pass-mark for the selection procedure.

It is intended for the selection procedure to be conducted remotely. Should the Selection Committee consider it necessary to conduct the selection procedure on-site at Europol in the interest of the proceedings, and subject to budget availability, the candidates invited to participate in the selection procedure will be informed accordingly.

After the selection procedure has taken place, the Selection Committee will establish a list of successful candidates, i.e. those scoring above the pre-defined pass-mark, which is shared with the AACC, for establishment of a Reserve list. A Reserve list is valid for 24 months.

Candidates who participated in the interview will be informed of the outcome, i.e. whether they have been successful or not.

COMPENSATION, TERMS AND CONDITIONS

All enquiries related to a selection procedure should be addressed to the Europol HR Operational Support Team at the following email address: C2-12@europol.europa.eu. Detailed information on the selection procedure- including enquiries, measures of redress and their applicable deadlines is available in the Europol Recruitment Guidelines, which can be found on Europol’s website www.europol.europa.eu.

Scale: AD6

Subject to the applicable conditions being met, as defined in the EU Staff Regulations (EUSR)/CEOS and further specified in the case law of the Court of Justice of the European Union, allowances such as expatriation allowance (16% of basic gross salary) or foreign residence allowance (4% of basic gross salary), household allowance, dependent child and / or education allowance may be granted.

Europol offers flexible working arrangements, a comprehensive provision for annual leave as well as parental leave supporting a healthy work-life balance.

1. Staff member (single) in receipt of expatriation allowance (16%): EUR 6674.05
2. Staff member with two dependent children in their custody in receipt of expatriation allowance (16%): EUR 8677.35

The above information is indicative and for information purposes only. It is merely meant to give an indication of the possible net salary in light of the currently applicable amounts of the related allowances and the level of taxation. It has no legal value and no rights can be derived from it.

The information is based on figures applicable as of January 2024.

Contract of employment

The overall duration of the contracts on restricted posts of Europol staff members will be taken into account if they are successful in the selection procedure.

Before the employment contract is concluded by Europol, the successful candidate will have to:

• declare any conflict of interest;
• undergo a pre-employment medical examination to confirm that he/she is physically fit to perform the duties pertaining to the post or, alternatively, receive the confirmation from Europol that he/she fulfils the conditions laid down in the Decision of the Deputy Executive Director of the Capabilities Directorate on the pre-employment medical examination available on www.europol.europa.eu;
• in case of candidates for restricted posts (including restricted - Annex II posts) who had indicated membership of a competent authority in one of the Member States, provide confirmation of his/her membership of a competent authority in one of the Member States within the meaning of the Article 2(a) of the Europol Regulation.

For further information on terms and conditions, please consult the EUSR/CEOS available on Europol’s website www.europol.europa.eu.

Europol reserves the right to terminate the contract of employment during or at the end of the probation period in accordance with Article 14 CEOS.

Security screening and certificate of good conduct

The certificate of good conduct must be issued by the relevant authorities of the country of nationality of the candidate and must not be older than three months at the time of submission to Europol. Europol reserves the right not to proceed with the signature of the contract based on the content of the certificate or if the candidate fails to provide the certificate to Europol.

The certificate of good conduct does not substitute a valid security clearance required for all Europol staff at the level indicated in the vacancy notice. Failure to obtain the requisite security clearance before the expiration of the probationary period may be cause for termination of the employment contract.

Europol may at any time terminate the employment contract if the result of the security screening is not positive and the necessary clearance level is not granted or extended.

The requested level of security clearance for this post is: CONFIDENTIEL UE/EU CONFIDENTIAL.

ADDITIONAL INFORMATION

Equal opportunity

All employment decisions are based on business needs, job requirements and qualifications, experience and skills.

Europol lives diversity and provides an inclusive work environment to all. Europol strives to recruit, develop and retain a diverse and talented workforce through application of equal opportunity and impartiality.

Privacy Notice

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, applies to the processing of personal data carried out in the process of selection and recruitment of staff at Europol, following the application of this Regulation to all administrative personal data held by Europol in accordance with Article 46 of the Europol Regulation.

Selection procedure: November-December

For further details on the application process and the selection procedure, please consult our FAQs or refer to the EUROPOL RECRUITMENT GUIDELINES available on Europol’s website.

In case of further questions please call +31 (0)70 302 5276 or +31 (0)70 353 1387.