About this role
Your team The Information Security team protects the organization by identifying, investigating, and helping mitigate an evolving range of cyber threats. Working across Cyber Operations and with business, technology, legal, compliance, and risk partners globally, the team uses digital evidence and investigative expertise to understand security events, determine scope and impact, preserve defensible evidence, and support timely, risk-based decisions.
Your role and impact As Vice President of Digital Forensics & Cyber Investigations, you will lead the development and operation of key elements of the digital forensics capability, providing technical leadership for complex investigations and helping mature forensic processes, tooling, and readiness across the organization. You will direct the collection, preservation, examination, and analysis of digital evidence across endpoints, servers, cloud services, identity platforms, networks, and other relevant technologies, translating technical findings into clear conclusions for Cyber Operations, business stakeholders, and senior leaders globally.
The role is well suited to an experienced investigator who combines deep forensic expertise with sound judgment, disciplined evidence handling, and strong leadership. Success requires integrity, intellectual curiosity, calm decision-making during high-severity events, and the ability to challenge assumptions while distinguishing established facts from investigative hypotheses.
Your responsibilities In every role at BlackRock, you'll be expected to apply sound judgement and critical thinking to solve complex problems, adapt as the business evolves, and combine the curiosity to explore new approaches and technologies with the rigor to challenge the results. The scope of this role also includes the following responsibilities:
- Lead complex digital forensic investigations across Cyber Operations, setting investigative strategy, coordinating technical workstreams, and providing senior technical oversight to ensure findings are timely, accurate, reproducible, appropriately qualified, and aligned with incident-response and business priorities.
- Own and mature forensic readiness, including evidence collection standards, chain-of-custody practices, forensic workflows, retention considerations, playbooks, tooling, and procedures that support defensible investigations at global scale.
- Direct the acquisition and analysis of endpoint, server, cloud, identity, network, application, and other digital evidence to reconstruct activity, determine root cause, establish timelines, assess scope, and identify indicators of compromise or misuse.
- Partner with incident response, threat intelligence, security engineering, detection, legal, compliance, employee relations, and investigative communities during complex or high-severity matters, providing technical judgment and communicating well-supported forensic conclusions to technical teams, business stakeholders, counsel, and senior executives.
- Develop and advance forensic capabilities through automation, repeatable analytical methods, testing, and appropriate technologies, while researching emerging developments such as artificial intelligence-generated content detection, anti-forensic use of generative tooling, and the capabilities and limitations of endpoint detection and response telemetry.
- Mentor investigators and promote strong forensic tradecraft, including precise documentation, peer review, evidence preservation, hypothesis testing, and lessons learned that strengthen future investigations and organizational resilience.
- Provide occasional off-hours support as needed for urgent incidents, time-sensitive investigations, and critical operational needs.
Your experience
- Demonstrated depth of experience in information security, digital forensics, incident response, cyber investigations, malware analysis, eDiscovery, or a closely related technical discipline, including experience leading complex investigations or technical teams.
- Deep knowledge of forensic principles and investigative tradecraft, including evidence preservation, chain of custody, forensic acquisition, timeline analysis, artifact interpretation, and the ability to distinguish facts, assumptions, and competing hypotheses.
- Hands-on experience investigating Windows, macOS, and Linux systems and analyzing common forensic artifacts such as file systems, event logs, registry data, process execution, persistence, authentication activity, browser artifacts, and endpoint telemetry.
- Experience conducting investigations across modern enterprise and cloud environments, including identity and Software as a Service (SaaS) platforms, endpoint detection and response data, network telemetry, and cloud audit logs; familiarity with Microsoft 365 and Azure/AWS environments is valuable.
- Experience using and helping shape forensic and investigative tooling such as EnCase, FTK, Magnet AXIOM, X-Ways Forensics, Velociraptor, KAPE, Volatility, Cellebrite, or comparable commercial and open-source capabilities, together with scripting or automation for evidence processing and analysis.
- Experience supporting major security incidents, insider-risk or misconduct investigations, litigation or regulatory matters, and other sensitive investigations where accurate documentation, confidentiality, and defensible evidence handling are essential.
- Ability to synthesize large volumes of technical evidence into concise investigative findings, timelines, executive briefings, and written reports that explain what occurred, what evidence supports the conclusion, remaining uncertainty, and recommended next steps.
For Wilmington, DE Only the salary range for this position is USD$138,000.00 - USD$186,500.00 . Additionally, employees are eligible for an annual discretionary bonus, and benefits including healthcare, leave benefits, and retirement benefits. BlackRock operates a pay-for-performance compensation philosophy and your total compensation may vary based on role, location, and firm, department and individual performance. Our benefits
To help you stay energized, engaged and inspired, we offer a wide range of benefits including a strong retirement plan, tuition reimbursement, comprehensive healthcare, support for working parents and Flexible Time Off (FTO) so you can relax, recharge and be there for the people you care about.
Our hybrid work model
BlackRock’s hybrid work model is designed to enable a culture of collaboration and apprenticeship that enriches the experience of our employees, while supporting flexibility for all. Employees are currently required to work at least 4 days in the office per week, with the flexibility to work from home 1 day a week. Some business groups may require more time in the office due to their roles and responsibilities. We remain focused on increasing the impactful moments that arise when we work together in person – aligned with our commitment to performance and innovation. As a new joiner, you can count on this hybrid model to accelerate your learning and onboarding experience here at BlackRock.
Guidance on AI use for candidates
At BlackRock, AI has long been part of how we work – enhancing decision-making, improving operations, and helping us deliver better outcomes for clients. We encourage candidates to use AI thoughtfully to learn, prepare, and work more effectively; but during our interview process, we want to focus on getting to know you through your own experiences, thinking, and judgment. To support you, we’ve provided guidance on when and how to use AI during our hiring process so you can approach each step with confidence and showcase your best self.
About BlackRock
At BlackRock, we are all connected by one mission: to help more and more people experience financial well-being. Our clients, and the people they serve, are saving for retirement, paying for their children’s educations, buying homes and starting businesses. Their investments also help to strengthen the global economy: support businesses small and large; finance infrastructure projects that connect and power cities; and facilitate innovations that drive progress.
This mission would not be possible without our smartest investment – the one we make in our employees. It’s why we’re dedicated to creating an environment where our colleagues feel welcomed, valued and supported with networks, benefits and development opportunities to help them thrive.
To learn more about BlackRock, please visit Careers.BlackRock.com. We also encourage you to get to know us on LinkedIn, Instagram, YouTube, X, and TikTok.
BlackRock is proud to be an equal opportunity workplace. We are committed to equal employment opportunity to all applicants and existing employees, and we evaluate qualified applicants without regard to race, creed, color, national origin, sex (including pregnancy and gender identity/expression), sexual orientation, age, ancestry, physical or mental disability, marital status, political affiliation, religion, citizenship status, genetic information, veteran status, or any other basis protected under applicable federal, state, or local law. View the EEOC’s Know Your Rights poster and its supplement and the pay transparency statement.
BlackRock is committed to full inclusion of all qualified individuals and to providing reasonable accommodations or job modifications for individuals with disabilities. If reasonable accommodation/adjustments are needed throughout the employment process, please email Disability.Assistance@blackrock.com. All requests are treated in line with our privacy policy.
BlackRock will consider for employment qualified applicants with arrest or conviction records in a manner consistent with the requirements of the law, including any applicable fair chance law.
