Specialist – Forensic Examiner (Decryption), Forensics Team, Digital Support Unit (AD6) - Job not limited to law enforcement candidate

Specialist – Forensic Examiner (Decryption), Forensics Team, Digital Support Unit (AD6) - Job not limited to law enforcement candidate - Reference numberEuropol/2026/TA/AD6/776 - Deadline:15 Oct 2026, 23:59 CEST - Department:O3 European Cyber Crime Centre (EC3) - TypeRestricted – Annex II - Contract type:Restricted Annex II Temporary Agent - Publish date23 Sept 2026 - Update date:24 Sept 2026 This selection procedure is intended to establish a reserve list of successful candidates. It is envisaged to start using the reserve list in Q4 of 2026/Q1 of 2027.Europol retains the right to make use of the reserve list to select candidates for similar posts within the organisation, should business needs require so.The post of Specialist - Forensic Examiner (Decryption) is considered a restricted post that may be filled without limitation to candidates coming from a competent authority, as stipulated in Annex II of the relevant Decision of the Management Board of Europol of 10 December 2025. The Europol Recruitment Guidelines may be consulted for further details. 1.     Organisational context Organisational setting: The post of Specialist - Specialist – Forensic Examiner (Decryption) is located is located in the Forensics Team in the Digital Support Unit, European Cybercrime Centre (EC3), Operations Directorate. The Operations Directorate deals with the core business of Europol, improving the effectiveness and cooperation of the competent authorities in the Member States (MS) in preventing and combating serious and organised crime, as well as terrorism affecting the MS. This requires close cooperation with the Liaison Bureaux at Europol and via them with the Operational Teams in the MS. Europol delivers a number of products and services to national law enforcement agencies to support them in their fight against international serious and organised crime, as well as terrorism. The Operations Directorate hosts six distinct Departments: Operational and Analysis Centre (OAC), European Serious Organised Crime Centre (ESOCC), European Cyber Crime Centre (EC3), European Counter Terrorism Centre, European Financial and Economic Crime Centre (EFECC) and European Centre Against Migrant Smuggling (ECAMS). EC3 serves as the centre for the MS fight against cybercrime in the European Union (EU), delivering operational and investigative support on complex cybercrime investigations. EC3 also provides support to the EU institutions and MS in building operational and analytical capacity for investigations and cooperation with external partners. EC3 is the collective voice of European cybercrime investigators across law enforcement and the knowledge hub of law enforcement on how to tackle cybercrime. The Digital Support Unit is assisting EC3 Operations and provides horizontal support to other Operations Centres of Europol by delivering intelligence products, technical and forensic support, decryption and cryptocurrency tracing services and facilitating technical assistance in handling large datasets  and conducting forensic examination through three dedicated teams: Cyber Intelligence Team (CIT), Forensics Team (FT) and Cryptocurrency Team. Purpose of the post: The jobholder is responsible for decryption services, digital forensics and advanced programming in order to support Europol and its partners in the fight against cyber-dependant crime. Reporting lines: The incumbent reports to the Head of Team Forensics/Head of Unit – Digital Support. Job environment: This post might require participation in a shift system including weekends and nights as well as on-call duty. 2.  Functions and duties The incumbent carries out the following main functions and duties: - Provide expert decryption and digital forensic services in the field of competence of Europol’s EC3 DSU Forensics Team, including on-site assistance when required; - Operate Europol’s Decryption Platform, liaise with Europol ICT and DG JRC to ensure continuity of Decryption Platform operations; - Act as a liaison with EU MS, EU bodies, third countries, and international organisations on decryption and digital forensic matters; - Support the projects of the Unit, such as organising meetings, training sessions and conferences; - Represent Europol at high-level digital forensic and digital security events across Europe and internationally; - Perform a technology foresight in the areas of decryption and digital forensics; - Contribute to the development of new decryption, access to data and digital forensic methods, tools, and best practices; - Independently draft and finalise reports, briefings, and strategic documents; - Perform any other duties in the area of competence as assigned by the line management. 3.     Requirements - Eligibility criteria a. Candidates must - Be a national of one of the Member States of the European Union and enjoy full rights as a citizen; - Have fulfilled any obligations imposed by the applicable laws on military service; - Produce appropriate character references as to his or her suitability for the performance of the duties; - Be physically fit to perform the duties pertaining to the post as further specified in Article 13 of the Conditions of Employment of Other Servants of the European Union (CEOS); - Produce evidence of a thorough knowledge of one of the languages of the Union and a satisfactory knowledge of another language of the Union to the extent necessary for the performance of the duties. b. Candidates must have - A level of education which corresponds to completed university studies of at least three years attested by a diploma; OR - Professional training of an equivalent level in a relevant area (e.g.Police Officer’s School) and after having completed the training, at least the number of years of relevant professional experience as indicated below: Duration of professional training            Additional professional experience required for equivalency More than 6 months and up to 1 year       3 years More than 1 year and up to 2 years           2 years More than 2 years                                          1 year - In additionto the above at least3years of total professional work experience gained after the award of the diploma. 4.     Requirements - Selection criteria Selection criteria: a.    Professional experience: Essential: - Experience in digital forensics and decryption; - Experience in designing, maintaining and operating large scale GPU based clusters; - Experience in development, deployment and use of workload distribution/parallel computing solutions; - Experience in programming using Python (CUDA, OpenCL would be an advantage); - Experience in development and use of automation solutions for digital forensics and wordlist building techniques. Desirable: - Experience in development of decryption software (plugins for hashcat, JtR); - Experience in Natural Language Processing (wordlist building) techniques; - Experience in engaging with subject matter expert groups, management of such groups and networking. b.    Professional knowledge: Essential: - Knowledge of baseline digital forensic investigation and examination techniques; - Knowledge of applied cryptography fundamentals - encryption algorithms, key derivation functions etc.; - In depth knowledge of hashcat usage and it's modes of operation; - Intermediate programming skills in Python. Desirable: - Knowledge of Natural Language Processing (wordlist building) techniques. c.      General competencies Essential: Communicating: - Very good communication skills in English, both orally and in writing; - Ability to draft clear and concise documents on complex matters for various audiences. Analysing & problem solving: - Keen eye for detail with the ability to maintain standards of accuracy under pressure of tight deadlines; - Excellent analytical and critical thinking skills; - Competent user of Microsoft Office applications (MS Word, Excel, PowerPoint and Outlook) and t