{"v":"2026-11-02","dataVersion":"ONET-30.3+BLS-MAY25","code":"15-1299.06","slug":"digital-forensics-analysts","title":"Digital Forensics Analysts","alt":["Cyber Analyst","Digital Analyst","Threat Analyst","Cybersecurity Analyst","Digital Cyber Analyst","IT Analyst","Malware Analyst","Cyber Threat Analyst","Cyber Forensics Analyst","Cyber Intelligence Analyst","Offensive Security Engineer","Incident Responder"],"employment":435370,"wage":{"median":116580,"p25":79370,"p75":157500},"growthPct":8.2,"exposure":61,"taskCount":20,"highCount":13,"midCount":3,"lowCount":4,"aeiObserved":3,"fit":{"mix":{"none":0,"efficient":65,"standard":15,"frontier":20},"counts":{"none":0,"efficient":13,"standard":3,"frontier":4},"recommended":"standard","coveragePct":80,"addressablePct":100},"tasks":[{"t":"Adhere to legal policies and procedures related to handling digital media.","imp":3,"exp":75,"src":"heuristic","tier":"standard","gwa":"Monitoring Processes, Materials, or Surroundings"},{"t":"Analyze log files or other digital information to identify the perpetrators of network intrusions.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Getting Information"},{"t":"Conduct predictive or reactive analyses on security measures to support cyber security initiatives.","imp":3,"exp":40,"src":"aei","tier":"efficient","gwa":"Analyzing Data or Information","auto":0.4804,"aug":0.5196},{"t":"Create system images or capture network settings from information technology environments to preserve as evidence.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Processing Information"},{"t":"Develop plans for investigating alleged computer crimes, violations, or suspicious activity.","imp":3,"exp":50,"src":"heuristic","tier":"standard","gwa":"Organizing, Planning, and Prioritizing Work"},{"t":"Develop policies or requirements for data collection, processing, or reporting.","imp":3,"exp":50,"src":"heuristic","tier":"frontier","gwa":"Thinking Creatively"},{"t":"Duplicate digital evidence to use for data recovery and analysis procedures.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information"},{"t":"Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.","imp":3,"exp":50,"src":"heuristic","tier":"frontier","gwa":"Making Decisions and Solving Problems"},{"t":"Maintain cyber defense software or hardware to support responses to cyber incidents.","imp":3,"exp":20,"src":"heuristic","tier":"efficient","gwa":"Repairing and Maintaining Mechanical Equipment"},{"t":"Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.","imp":3,"exp":20,"src":"heuristic","tier":"efficient","gwa":"Updating and Using Relevant Knowledge"},{"t":"Perform file signature analysis to verify files on storage media or discover potential hidden files.","imp":3,"exp":80,"src":"heuristic","tier":"efficient","gwa":"Getting Information"},{"t":"Perform forensic investigations of operating or file systems.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Getting Information"},{"t":"Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.","imp":3,"exp":75,"src":"heuristic","tier":"efficient","gwa":"Getting Information"},{"t":"Preserve and maintain digital forensic evidence for analysis.","imp":3,"exp":20,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information"},{"t":"Recommend cyber defense software or hardware to support responses to cyber incidents.","imp":3,"exp":60,"src":"heuristic","tier":"frontier","gwa":"Providing Consultation and Advice to Others"},{"t":"Recover data or decrypt seized data.","imp":3,"exp":75,"src":"heuristic","tier":"standard","gwa":"Interpreting the Meaning of Information for Others"},{"t":"Write and execute scripts to automate tasks, such as parsing large data files.","imp":3,"exp":95.03,"src":"aei","tier":"frontier","gwa":"Working with Computers","auto":0.7582,"aug":0.2418},{"t":"Write cyber defense recommendations, reports, or white papers using research or experience.","imp":3,"exp":60,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information","auto":0.4127,"aug":0.5873},{"t":"Write reports, sign affidavits, or give depositions for legal proceedings.","imp":3,"exp":85,"src":"heuristic","tier":"efficient","gwa":"Documenting/Recording Information","auto":0.3636,"aug":0.6364},{"t":"Write technical summaries to report findings.","imp":3,"exp":64.9,"src":"aei","tier":"efficient","gwa":"Documenting/Recording Information","auto":0.5138,"aug":0.4862}],"adjacent":[{"code":"15-1212.00","slug":"information-security-analysts","title":"Information Security Analysts","overlap":0.7,"months":11,"exposure":65.1,"strong":true},{"code":"13-2099.04","slug":"fraud-examiners-investigators-and-analysts","title":"Fraud Examiners, Investigators and Analysts","overlap":0.67,"months":12,"exposure":59.6,"strong":true},{"code":"33-3021.06","slug":"intelligence-analysts","title":"Intelligence Analysts","overlap":0.66,"months":12,"exposure":68.9,"strong":true},{"code":"33-3021.00","slug":"detectives-and-criminal-investigators","title":"Detectives and Criminal Investigators","overlap":0.63,"months":13,"exposure":32.9,"strong":false},{"code":"19-4092.00","slug":"forensic-science-technicians","title":"Forensic Science Technicians","overlap":0.63,"months":13,"exposure":66.2,"strong":false}]}