CSIS Digital Forensic Investigator

The CSIS Lead Investigator is a strategic professional who stays abreast of developments within own field and contributes to directional strategy by considering their application in own job and the business. Recognized technical authority for an area within the business. Requires basic commercial awareness. There are typically multiple people within the business that provide the same level of subject matter expertise. Developed communication and diplomacy skills are required in order to guide, influence and convince others, in particular colleagues in other areas and occasional external customers. Significant impact on the area through complex deliverables. Provides advice and counsel related to the technology or operations of the business. Work impacts an entire area, which eventually affects the overall performance and effectiveness of the sub-function/job family.

Responsibilities:

• An Investigator will be responsible for the coordination and investigation of high level fraud matters and/or network security incidents

• This role will utilize sophisticated expertise in investigative interviewing, fraud identification, loss prevention, network security, cyber enabled fraud, to identify fraud activities, schemes, trends and organized rings that create a risk to our firm, its employees, shareholders, systems, assets and clients

• Conduct proactive, complex, variable and high profile/sensitive investigations with the goal of developing cases to a successful conclusion and providing timely fraud preventive intelligence to business and functional partners

• Actively engage partners and management to ensure they are kept apprised of any significant changes during the progress of an investigation

• Responsible for the recovery of losses through court ordered restitution, property or direct payment by suspects

• Build external relationships with members of law enforcement, industry peers and other sources of support

• Engage with internal and external suspects, witnesses and third parties through interview and interrogation, evidence collection and forensic examination

• Represent Citi in criminal and civil court matters and have the ability to show knowledge and provide accurate and supportive testimony

• Mentor and train junior staff members

• Brief others on an ongoing investigations/investigative projects

• Has the ability to operate with a limited level of direct supervision.

• Can exercise independence of judgement and autonomy.

• Acts as SME to senior stakeholders and /or other team members.

• Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency.

Qualifications:

• 6-10 years of experience

• Ability to conduct investigative interviews and recording techniques that tie the facts and evidence together

• Experience investigating complex and variable case(s) that has substantial impact

• Understanding of forensic and eDiscovery processes and procedures to include the collection, examination, and analysis of data while preserving integrity and maintaining a strict chain of custody

• Experience representing/testifying in criminal and civil court matters

• Conveys mastery of investigative concepts

• Demonstrated report writing that would present the case and evidences gathered in a cohesive and comprehensive manner

• Knowledge of financial products, frauds and trends

• Previous US Intelligence, military, law enforcement, law firm or government service background

• Experience working in an in-house investigations team

• Professional certifications (GCFE, GCFA, or equivalent)

• Proficiency in Microsoft Office products - Word, Excel, Outlook, PowerPoint, & SharePoint for compiling written reports and spreadsheets on an investigation

• Flexibility to work on call off hours/weekends during critical project phases, if necessary

Education:

• Bachelors degree, potentially Masters degree

This job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.

#LI-EL1

Knowledge and Skills Required:

Computer forensics experience with knowledge of Windows and Linux operating systems and their file systems.

Experience conducting various system log analysis, such as Proxy logs, Window event logs, Purview and firewall logs.

Experience with various standard forensic acquisition and analysis suites, such as Encase, Axiom, FTK, and Cellebrite.

Excellent communication for conducting case work and obtaining cooperation of other parties.

An ability to multi-task, demonstrated attention to detail with ability to manage caseload and produce accurate, concise analytical reports.

Expresses ideas or facts in a clear, concise, and open manner

Knowledge and Skills Preferred Knowledge of enterprise cloud computing environments (AWS, Azure, GCP) and associated security controls.

Knowledge in utilizing Log Aggregation tools (Splunk) and the ability to query and analyze large datasets.

Experience in Memory forensics, analyzing volatile memory detecting hiding processes, and rootkits.

Experience in Network analysis investigating network connections and active sockets to identify various communication channels.

Experience is utilizing various open-source forensic tools such as: (Autopsy, Volatility, and Wireshark)

Experience in Automation and Scripting developing custom scripts utilizing Python and PowerShell to automate artifact collection and log parsing.

---

Job Family Group:

Corporate Services

---

Job Family:

Investigations

---

Time Type:

Full time

---

Primary Location:

Irving Texas United States

---

Primary Location Full Time Salary Range:

$114,720.00 - $172,080.00

In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards. Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs. Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays. For additional information regarding Citi employee benefits, please visit citibenefits.com. Available offerings may vary by jurisdiction, job level, and date of hire.

---

Most Relevant Skills

Please see the requirements listed above.

---

Other Relevant Skills

For complementary skills, please see above and/or contact the recruiter.

---

Anticipated Posting Close Date:

Sep 23, 2026

---

Automated Processing and AI

We use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.

Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.

Illinois residents – AI Notice and Right

---

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

*If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi’s EEO Policy Statement and the Know Your Rights poster.*