Specialist – Forensic Examiner (Digital Forensics), Forensics Team, Digital Support Unit(AD6) - Job not limited to law enforcement candidate

Specialist – Forensic Examiner (Digital Forensics), Forensics Team, Digital Support Unit(AD6) - Job not limited to law enforcement candidate - Reference numberEuropol/2026/TA/AD6/777 - Deadline:15 Oct 2026, 23:59 CEST - Department:O3 European Cyber Crime Centre (EC3) - TypeRestricted – Annex II - Contract type:Restricted Annex II Temporary Agent - Publish date23 Sept 2026 - Update date:24 Sept 2026 This selection procedure is intended to establish a reserve list of successful candidates. It is envisaged to start using the reserve list in Q4 of 2026/Q1 of 2027. Europol retains the right to make use of the reserve list to select candidates for similar posts within the organisation, should business needs require so. The post of Specialist - Forensic Examiner (Digital Forensics) is considered a restricted post that may be filled without limitation to candidates coming from a competent authority, as stipulated in Annex II of the relevant Decision of the Management Board of Europol of 10 December 2025. The Europol Recruitment Guidelines may be consulted for further details. 1. Organisational context Organisational setting: The post of Specialist - Forensic Examiner (Digital Forensics) is located is located in the Forensics Team in the Digital Support Unit, European Cybercrime Centre (EC3), Operations Directorate. The Operations Directorate deals with the core business of Europol, improving the effectiveness and cooperation of the competent authorities in the Member States (MS) in preventing and combating serious and organised crime, as well as terrorism affecting the MS. This requires close cooperation with the Liaison Bureaux at Europol and via them with the Operational Teams in the MS. Europol delivers a number of products and services to national law enforcement agencies to support them in their fight against international serious and organised crime, as well as terrorism. The Operations Directorate hosts six distinct Departments: Operational and Analysis Centre (OAC), European Serious Organised Crime Centre (ESOCC), European Cyber Crime Centre(EC3), European Counter Terrorism Centre, European Financial and Economic Crime Centre (EFECC) and European Centre Against Migrant Smuggling (ECAMS). EC3 serves as the centre for the MS fight against cybercrime in the European Union (EU), delivering operational and investigative support on complex cybercrime investigations. EC3 also provides support to the EU institutions and MS in building operational and analytical capacity for investigations and cooperation with external partners. EC3 is the collective voice of European cybercrime investigators across law enforcement and the knowledge hub of law enforcement on how to tackle cybercrime. The Digital Support Unit is assisting EC3 Operations and provides horizontal support to other Operations Centres of Europol by delivering intelligence products, technical and forensic support, decryption and cryptocurrency tracing services and facilitating technical assistance in handling large datasets and conducting forensic examination through three dedicated teams: Cyber Intelligence Team (CIT), Forensics Team (FT) and Cryptocurrency Team. Purpose of the post: The jobholder is responsible for providing digital forensics services and advanced programming in order to support Europol and its partners in the fight against cyber-dependant crime. Reporting lines: The incumbent reports to the Head of Team Forensics/Head of Unit – Digital Support. Job environment: This post might require participation in a shift system including weekends and nights as well as on-call duty. 2. Functions and duties The incumbent carries out the following main functions and duties: - Provide expert digital forensic services in the field of competence of Europol’s EC3 DSU Forensics Team, including on-site assistance when required; - Operate, maintain and develop solutions designed to automate digital forensic and data minimisation workflows and reporting. Liaise with Europol ICT on this topic; - Represent Forensic Team in EU MS, EU bodies, third countries, and international organisations on digital forensic matters; - Support projects of the Unit, such as organising meetings, training sessions and conferences; - Represent Europol at high-level digital forensic and digital security events across Europe and internationally; - Contribute to and conduct research and development of new digital forensic and automation methods, tools, and best practices; - Independently draft and finalise reports, briefings, and strategic documents; - Perform any other duties in the area of competence as assigned by the line management. 3. Requirements - Eligibility criteria a. Candidates must - Be a national of one of the Member States of the European Union and enjoy full rights as a citizen; - Have fulfilled any obligations imposed by the applicable laws on military service; - Produce appropriate character references as to his or her suitability for the performance of the duties; - Be physically fit to perform the duties pertaining to the post as further specified in Article 13 of the Conditions of Employment of Other Servants of the European Union (CEOS); - Produce evidence of a thorough knowledge of one of the languages of the Union and a satisfactory knowledge of another language of the Union to the extent necessary for the performance of the duties. b. Candidates must have - A level of education which corresponds to completed university studies of at least three years attested by a diploma; OR - Professional training of an equivalent level in a relevant area (e.g.Police Officer’s School) and after having completed the training, at least the number of years of relevant professional experience as indicated below Duration of professional training      Additional professional experience required for equivalency More than 6 months and up to 1 year    3 years More than 1 year and up to 2 years        2 years More than 2 years                                       1 year - In additionto the above at least3years of total professional work experience gained after the award of the diploma. 4. Requirements - Selection criteria Selection criteria:a. Professional experience: Essential - Preferably at least 5 years’ experience in digital forensics using standard forensic tools (commercial and open-source solutions); - Experience in automating the processing and indexing of large structured and unstructured datasets; - Experience in designing, building, and operating automated processing pipelines or workflow orchestration; - Experience in software development in Python with proficiency in PowerShell, Bash and command-line scripting; - Experience working with SQL and structured data stores, including SQLite; - Experience with containerisation (Docker) and CI/CD, and with developing reusable APIs, libraries, plugins or automation frameworks. Desirable: - Experience integrating multiple third-party tools and services into end-to-end automated workflows via REST APIs, command-line interfaces and JSON/XML; - Experience applying AI technologies to support digital forensic workflows; - Experience integrating Large Language Models (LLMs) into automation solutions. b. Professional knowledge: Essential: - Knowledge in digital forensics investigation and examination techniques, including acquisition methods, file systems, data minimisation and chain of custody; - Knowledge in Windows and Linux operating systems and their forensic artefacts; - Knowledge of software engineering principles, including testing, debugging, and version control; - Ability to analyse existing forensic processes, identify opportunities for automation, and engineer scalable, maintainable, and validated workflow solutions; - Knowledge of Indexing and search at scale: text extraction, OCR, deduplication, index integrity, and the behaviour of Lucene/Elasticsearch/dtSearch-style engines. Desirable: - Applying AI and LLM’s within aut