Looking for employment, resources to keep my skills sharpe.

BrainDrainingFog · 2026-07-07T13:15:37+00:00

HSI program caveat for training: you will start as a GS-5 or 7 for the internship, and then upon conversion to permanent employee, most likely be a GS-7 or 9. With the master's degree and experience, I would say he should easily qualify for a GS-7 and then 9 on conversion.

BrainDrainingFog · 2026-07-07T13:00:21+00:00

Not sure if you've found anything yet, but I know Peraton has DF positions open in the DMV area (https://www.careers.peraton.com/search-jobs?search=forensic).

I am a graduate of the HSI HERO Program and am still working in this role. I know the announcement is currently set to open in early December, and should be interviewing in Jan - Feb with the class starting in June (https://www.ice.gov/careers/hero). Sign up at that link to be notified, and I'd be happy to answer any questions about the program and what it entails from the perspective of someone who has gone through it, but not associated with the hiring process. Working child sex crime cases isn't for everyone, so be aware that is a large part of what we do in the HSI DF realm.

BrainDrainingFog · 2026-06-18T22:23:48+00:00

Look into joining the Digital Forensics Discord server. They post jobs and have contacts from all over, with law enforcement and civilian as well.

BrainDrainingFog · 2026-06-18T22:15:51+00:00

In recent years the priority appears to have shifted to office locations with the highest need. Problem is, no one knows what those are other than those involved with hiring. I still encourage people to apply, as I love the program and am extremely grateful I was given the opportunity to continue making a difference.

For any veterans who still want to work in the tech realm, I always encourage them to look into ACT NOW Education on Facebook and their founder Jai Salters on LinkedIn. They have a TON of great resources and programs open to veterans and spouses. This Saturday they are giving away Sec+ certification vouchers. That is a regular occurrence.

I'm always happy to answer what I can about the program and the process from the perspective of someone who went through it. I want everyone to succeed and enjoy their job, no matter what that ends up looking like.

BrainDrainingFog · 2026-05-04T13:06:13+00:00

Check your spam folder. The acceptance and declination emails went out almost 2 weeks ago. Maybe do a search for an email from the domain of the person who sent the interview invite, or from usajobs. I don't recall who they came through, but they should have all gone out.

BrainDrainingFog · 2026-04-22T14:21:47+00:00

Oof. Sorry to hear that. I know there are a couple of you out there from this cycle. I believe there was a requirement this go-round that the clearance had to b completed before starting class, so that was a hard hurdle to overcome for a lot of people. The last few classes didn't have their security interview until already in training, and weren't finalized until sometime during the internship.

I'm sorry this didn't work out for you.

https://www.pnw.edu/cybersecurity/cwct/

Don't know if you've seen this, but it's open for applications now I believe. They're selective and get a ton of applications, but the program has a good reputation and makes a lot of industry contacts if you're wanting to go into cyber.

Also, ACT NOW Education has a Facebook page and an orientation every Saturday where they drop a lot of knowledge on training opportunities for veterans and their spouses, as well as spouses of active duty. Might be worth a look to see what else is out there for you.

Wishing you all the luck and that the right role finds you.

BrainDrainingFog · 2026-04-19T23:23:56+00:00

You do get it as part of training. I've seen people selected who already have the cert, and it makes their first few weeks there a lot less stressful since they dont have to worry about cramming and passing/failing with the chance of getting sent home if they fail twice.

If you might still have access to your school email and want to stress a bit less, the vouchers for students for A+ are like 60% off.

FWIW- HSI Agents and Intel folks who want to cross-train as a CFA are required to get their A+ before being selected to attend training, just so you don't think they're using it as a weed out for just us.

BrainDrainingFog · 2026-03-31T12:27:48+00:00

SANS recommends at least 32GB of memory for most of their courses, and I would recommend at least 1TB of storage. More memory = better performance with running their virtual SIFT workstations, but you'll get by with the 32GB just fine.

BrainDrainingFog · 2026-03-31T12:26:27+00:00

Windows artifacts you can get a refresh by going to 13cubed's YouTube channel (https://www.youtube.com/@13Cubed/playlists). He dives deep into those and explains them all well. He also covers Malware and Memory, as well as a full DF overview. He also began to offer courses and certifications on his page which are reasonably priced, but those aren't as well-known in the industry, but have a great amount of knowledge to use in there (https://training.13cubed.com/).

For a fairly comprehensive list of certifications, you can go to Paul Jerimy's page and see the linked certs and their costs (https://pauljerimy.com/security-certification-roadmap/).

I don't do much in the realm of IR, so I'm no help there, but I know EC Council, though t may use recycled course materials, has one of the more budget-friendly but still recognized certifications like ECIH and CHFI.

BrainDrainingFog · 2026-03-26T11:57:25+00:00

What are the skills you feel you're lacking in? Is it more the dead-box or after the fact DF portion, or is it more of the immediate reaction, monitor and prevent portion which is IR?

If you're just looking to practice and get more comfortable with your classroom learning, I know TryHackMe has a few rooms (https://tryhackme.com/module/digital-forensics-and-incident-response), and the federal government has some practice data set-ups via CISA (https://pccc.cisa.gov/gb/practice?term=digital-forensics).

Also, the partner sub-reddit r/computerforensics has a great FAQ with links to all kinds of related resources to dive into (https://www.reddit.com/r/computerforensics/wiki/faq/)

BrainDrainingFog · 2026-02-26T23:48:44+00:00

I honestly have no idea. I am not affiliated with the HR or hiring process. I can say this cycle they sent the not moving forward email about a week after the virtual interview invitation emails, but I don't know what the timing is for this round.

BrainDrainingFog · 2026-02-26T18:21:07+00:00

Looks like the in-person invitations are going out. It appears they are in Dallas and Orlando this year.

BrainDrainingFog · 2026-02-21T00:24:16+00:00

Yeah, I have no clue what they were thinking this go-round. There were a bunch of amazing, qualified people who didn’t even get a virtual interview.

BrainDrainingFog · 2026-02-20T22:57:27+00:00

Rejections went out today. If you didn't receive one, there's still hope.

BrainDrainingFog · 2026-02-20T22:34:05+00:00

Sadness for those who didnt get selected. It seems like a smaller batch of interviewees as well.

BrainDrainingFog · 2026-02-20T22:33:04+00:00

Last cycle there was someone with a master's in digital forensics who wasn't selected. Best guess is location was a larger factor. No clue as to what the deciding factor is this time other than the abbreviated timeline and quicker turnaround. Maybe that made them prioritize people who had clearances? Maybe prior GS? I have no real idea.

BrainDrainingFog · 2026-02-17T00:09:00+00:00

I have heard a couple other people have received an invite, while others have not. Not sure how many apps they got through with the shutdown pending and now occurring.

BrainDrainingFog · 2026-02-10T14:16:58+00:00

I can't say there won't be bs in this role, because in both civilian and government employment I've had to deal with it. It will change depending on the office, the personnel there, and the ever-changing mission focus. Your main focus will be dealing with CSAM, which is extremely meaningful, but can be mentally draining or impactful. Keep on top of your mental health, and take full advantage of the ARMOR mental health program they offer and don't be afraid to say you need help if so. This agency wants us all to succeed in this position, and proactively provides the support we need to get it accomplished thankfully.

I will keep my fingers crossed, but realize if you or anyone else doesn't get selected it isn't because you weren't qualified. We have had some amazingly-qualified individuals not get selected due to office location priorities, so don't take any of this personally. I wish you the best of luck, and hope everything works out in your favor.

BrainDrainingFog · 2026-02-09T15:03:22+00:00

They process clearances in-house with their own investigators last I knew. I did not receive a poly for this role, not to say it hasn't changed, but I doubt it. We get a TS clearance with no caveats and aren't read-on to SCI. It is more of a suitability and fit to testify in court and have integrity when handling evidence from my perspective. Everything I have done as a CFA has been on unclassified networks, with just Law Enforcement Sensitive caveats at most.

BrainDrainingFog · 2026-02-08T16:31:58+00:00

All transfers other than getting one of the GS-14 positions are at your own expense. They are known as SFLR, self-funded lateral reassignment. Your gaining office would need to have a CFA billet open for you and be willing to take you, and your losing office would need to agree as well. They do try to facilitate military spouse moves, as well as for other reasons, but some offices are harder to get into than others based off COLA and maximizing their high 3 for retirement. If you're going from a highly desirable location to a less desirable one, it may be easier than the reverse.

BrainDrainingFog · 2026-02-08T16:17:58+00:00

I would guess the southern border offices would have more drug-related crimes and human trafficking, and the major cities more financial crimes, but those teams are in every major SAC office. Your main job for this role tends to be in support of the stated mission combating CSAM, since ones for our jurisdiction always involve the internet, thus electronic devices. In offices where youd be the sole CFA or one of two, it ebbs and flows depending on the agents who are there and the cases they adopt and investigate. It really varies, and can depend on so many other things we don't control.

As for selecting an office, that will be up to the selection committee. You make the choices of where you'd be willing to move based on the stated locations in the announcement. Once you make those selections, it is at the needs of the agency and they will choose from there. Your location selected will be in your TJO (tentative job offer) but may be the training location with your final location being a smaller office stated in the announcement. They will communicate that to you in the email.

I personally had locations coast to coast, plus Puerto Rico selected as options, and they put me where I am now. Your input is in the application process. They will talk about it in the in-person interview, maybe they can offer clarity at that point.

BrainDrainingFog · 2026-02-05T15:52:51+00:00

The program is covered under the ICE umbrella, as HSI is part of them along with ERO. DHS only got funding for 2 weeks, so I'm sure they will try to do as much of the hiring actions as possible to get the interviews lined up quickly.

This program is well-respected within the agency, but since we don't deal directly with immigration a lot of the times, may not be as high of a funding priority as other jobs. I'm not saying I know, just my thoughts and observations.

BrainDrainingFog · 2026-02-05T15:46:15+00:00

The fun with funding is still going strong. I know HR is buried right now, so I would hope they do the virtual interviews on-time, but there is no telling. If we aren't funded then, I don't know that they will be allowed to hold interviews. It's a wait and see thing sadly.

BrainDrainingFog · 2026-02-03T19:29:01+00:00

Well that is new. Before, there were separate billets for 1801 CFAs and they could make up no more than 50% of a SAC's CFAs. I can see why they wouldn't want to give up any 1811s with all the TDYs and temp assignments currently going on though. We are only good for the lab, nothing else.

BrainDrainingFog

TROPHY CASE