Tips on finding qua...
 
Notifications
Clear all

Tips on finding qualified entry-level examiners?

9 Posts
7 Users
0 Likes
345 Views
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
Topic starter
 

I run a small digital forensics lab that is part of a large-ish accounting firm. At the moment, it's just me in my lab and one person in another city who focuses more on incident response and helps with forensics when I need him. The practice has grown much faster than I anticipated, and I need to hire an entry-level examiner to help.

Where do you usually recruit your examiners? Are there schools with particularly good programs? I'm in the Southeastern US, so I'd like to focus on those schools. Other than schools, are there other places I should consider recruiting? What skill sets do you find usually make a good examiner? I'm thinking we need an aptitude for the technical skills, but more important is that curiousity an investigator needs. Any tips are greatly appreciated.

Can anyone give me an idea of the salary range for an entry-level examiner? We have a good handle on what to pay CPA-candidates coming out of grad school, but I have no idea what DF examiners are typically paid.

Finally, this isn't really a job posting, which is why I avoided that forum, but if you are looking, send me a PM.

 
Posted : 20/06/2013 8:06 pm
(@patrick4n6)
Posts: 650
Honorable Member
 

Based upon the experience I had with interns last summer I recommend you incorporate practical testing into your interview process. Kids are coming out of college with advanced degrees in CF and can't do basic work.

 
Posted : 20/06/2013 11:10 pm
(@daddio)
Posts: 3
New Member
 

I would also recommend a few brief practical tests about a week apart - recognizing of course that in an interview situation, a candidates jittery nerves added to the pressure of the situation may not make for the best indicator of knowledge and/or performance.

That said, Kennesaw State University in Georgia, and the University of Central Florida have fairly extensive programs in forensics, with UCF having the bigger and more applied infrastructure for it. In the northeast, Champlain College has been in the forefront of digital Forensics for years.

The ISFCE (Intl Society of Forensic Computer Examiners - http//www.isfce.com/training.htm) website lists some other Computer Forensics learning centers as well

Champlain College
Canadian Institute of Learning
Australian Forensic Services
Emory University
Western Iowa Tech Community College

Hope this helps a bit….

 
Posted : 20/06/2013 11:47 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Based upon the experience I had with interns last summer I recommend you incorporate practical testing into your interview process. Kids are coming out of college with advanced degrees in CF and can't do basic work.

You're not the only one seeing this…

http//www.ericjhuber.com/2013/05/ever-get-feeling-youve-been-cheated.html

 
Posted : 21/06/2013 12:47 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Where do you usually recruit your examiners? Are there schools with particularly good programs? I'm in the Southeastern US, so I'd like to focus on those schools. Other than schools, are there other places I should consider recruiting? What skill sets do you find usually make a good examiner? I'm thinking we need an aptitude for the technical skills, but more important is that curiousity an investigator needs. Any tips are greatly appreciated.

I ran across this same sort of thing at IBM ISS, when we went through two rounds of hiring.

In short, how do you quantify intangible abilities?

I found that I most often had to start by defining what it was we were looking for. In our case, our ERS team was geographically dispersed, and everyone pretty much was responsible for themselves. There are some folks that simply do not work well in that environment, but how do you "test" for something like that during the interview process?

More important than outright skills, because you're looking for entry-level folks, is the ability to get passed apparent obstacles, but to do so by not speculating and incorrectly assuming things. You could give them a simple analysis scenario, and give them some time to digest it, and then have them walk through their methodology or process. I found this sort of thing to be telling…someone would say, "I'd do Registry analysis", and that would open the door for the question, "Ok…what would you look for, and why?"

Another approach is to ask them which blogs they read, during a phone interview. If you move on to a face-to-face interview, ask them their thoughts on some of posts from the blog(s) they mentioned. Another approach is to ask if they maintain their own blog, and get the address. This might give you some insight into their thought process, as well as their writing ability.

 
Posted : 21/06/2013 12:55 am
pbobby
(@pbobby)
Posts: 239
Estimable Member
 

Then again, by entry level, you can't expect too much in the way of real-world practical experience. Using tools and doing projects in academia doesn't really count - but for entry level, what do you expect?

Practical testing for the sake of discovering approaches and thought processes sure, but if they get the answer wrong, that shouldn't be an issue.

 
Posted : 21/06/2013 7:32 pm
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
Topic starter
 

Thanks everyone for your comments. I will certainly look at doing some simple tests during the interview process. Any additional suggestions about schools to look at are greatly appreciated. I think I have two in the Southeast from this thread.

I agree that I can't expect too much from an entry-level person. My goal is to find someone with a very good understanding of how computers work and has a high level of curiosity. That person may not even have a specific digital forensics degree. I can send them to training on how to use the tools–in fact I assume my first year training budget will need to be quite large for anyone I hire.

Does anyone have any successes (or failures) they would like to share in the hiring process? In our more general litigation support practice, we've had a few failures with people who looked good on paper but were so scared of speaking and so emotional when confronted that we knew they would crumble at deposition or trial. During the interview process, we now ask ourselves if we can see this person doing well testifying in the future. I would be looking for the same in a new DF examiner.

 
Posted : 21/06/2013 8:40 pm
flamerescue150
(@flamerescue150)
Posts: 23
Eminent Member
 

Bloomsburg University has a good program that gives their students plenty of practical experience. If you contact their lead professor, he would likely be willing to help hand pick graduating students that would be a good fit for your needs.

 
Posted : 21/06/2013 9:21 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

My experience having worked in biggish labs and small companies is that as a small company/dept you may find that the overhead of hand holding a newbie means that you have much less time to spend on productive work than you had before you hired him/her.

My preferred route was to employ experienced practitioners who could hit the ground running, the money you save on the training budget would pay the extra salary required and the experienced guy/gal could be a fee earner from day one.

Of course you may be lucky and find that recent grad who picks things up really quickly - but in my experience they are unfortunately few and far between.

 
Posted : 21/06/2013 9:29 pm
Share: