Notice of job opportunity

This notice of job opportunity is closed and you can no longer submit an application.

Computer Forensic Analyst

Region: Pacific
Location: Vancouver (Downtown/centre ville) BC/C-B
Contract type: Anticipatory - Acting,Lateral Move,Permanent,Promotion
Classification: CS-002
Linguistic profile: English Essential
Salary range: $83,852 to $102,646
Closing date: June 17, 2016 11:59 PM Eastern Time
Requisition Number: 50779070

Who can apply

Persons living in Canada and Canadian citizens living abroad.

Preference for appointment will be given to preferred status and to Canadian citizens, in that order.

Please note that this process will be used to staff positions in Vancouver, BC only and as a result, we will expect candidates appointed from this process to relocate to this location. External candidates will have to pay any expenses (i.e. travel, moving, etc.) related to relocation.

Qualified veterans, members and former members of the Canadian Forces who are appointed are not entitled to relocation costs from the CRA. They may, however, be entitled to a final relocation from the Department of National Defence.

The area of selection includes individuals with preferred status who live or work within the general rule of minimum distance of the position(s) being staffed.


The Canada Revenue Agency's Criminal Investigations Division is currently recruiting Computer Forensic Analysts (CFA) to join its dynamic team in Vancouver.

The key activities of the CFA are as follows:

Provides digital forensic investigative services relating to the recovery and examination of data from computers and other electronic storage devices in order to use the data as evidence in criminal prosecutions. These services include search, seizure, recovery, decryption, preservation and analysis of data, relevant to criminal investigations.

Conducts on-site search and seizure of taxpayers' data and information systems, located at the search site or available to it, through the processing, analysis and evaluation of files, data, hardware and software seized pursuant to the terms of the search warrant.

Prepare reports detailing how the computer evidence was discovered and all of the steps taken during the retrieval process for use during the investigation, prosecution and trial, i.e., review, process and analyze seized digital evidence by identifying, separating, organizing and rendering the relevant digital evidence into a readable, searchable, indexed and organized format.

Provides testimony in court regarding the evidence collected and methodologies used to acquire the evidence.

Troubleshoots issues encountered, throughout the course of the investigation, on internal (forensic computer software and hardware) and external devices, i.e., seized digital devices and systems, including large and complex networks, computers, servers, cell phones, tablets, all storage media, software and other peripherals, issues encountered during the collection, recovery, preservation and processing stages.

Installation, maintenance and testing of the forensic computing environment (hardware, software and forensic techniques) and related equipment; analyzes and evaluates computer systems and software proposed for implementation and makes recommendations.

Prepares and disseminates forensic software, tools and equipment; i.e., prepares, configures and tests forensic laptop image and other tools before they are available for use in cases and provides training on same.

Ensures that adequate steps are taken and/or proposes new methodology to ensure the security of data related to criminal investigations between CRA offices and external partners including the Public Prosecution Service of Canada (PPSC), defence lawyers and other enforcement agencies.

Assists in conducting research, validating tests and attends training into new technology and develops new techniques to update and improve forensic processes and tools used in the searching, seizing, preserving, processing and presentation of digital devices and electronically stored information. Installs and provides technical guidance in relation to the setup of mobile electronic courtroom equipment.

Develops, maintains and cultivates a network/partnership with stakeholders, other law enforcement agencies, etc.; ensures that communications are consistent and solicits cooperation, joint participation on cases, as required; and promotes the sharing of technical training and expertise.

Selects and educates investigators on the use of litigation support applications suitable for e-disclosure, in conjunction with the PPSC; creates, develops and maintains databases for litigation support purposes; assists in the design of investigative databases; and maintains documentation for litigation support software and related databases.

Provides guidance and technical assistance/support in resolving/executing forensic issues/solutions pertaining to solicitor-client privilege claims; e.g. arriving at a mutually agreeable protocol for the examination of sealed computer media, processing potential privileged data, reporting to the court and providing assistance as required during the privilege hearing.

Staffing Requirements to apply

You must clearly demonstrate on your online application how you meet the essential staffing requirements to apply.


You must attach proof of a degree, diploma or approved equivalent (as detailed below) to your candidate profile at the time of application or you will no longer be considered for this staffing process.

A degree or a diploma from a recognized postsecondary institution, in computer science, information technology (IT), information management, or other specializations relevant to the position.


Any degree from a recognized postsecondary institution; and Three years of IT experience.*

*IT experience must be validated by ITB's CS Education Committee.

Approved Education alternatives

At the authorized person's discretion, an acceptable combination of education, training, and/or experience may serve as an alternative to the minimum education standard:

Two years of postsecondary education in a relevant program (a recognized educational institution determines if the courses taken by a candidate correspond to two years of a postsecondary program at that institution); and
Three years of IT experience;

A secondary school diploma; or CRA-approved alternatives; and
An IT certificate; and
Two years of IT experience;

A secondary school diploma or CRA-approved alternatives; and
Specialized training (outside of a recognized degree or diploma program); and
Four years of IT experience;

A secondary school diploma or CRA-approved alternatives; and
Five years of IT experience.

Acquired rights
Permanent incumbents of CS positions in the CRA who, on February 6, 2002, who did not meet the minimum standard are deemed to have met the minimum education standard based on their education, training, and/or experience.

Permanent incumbents in the CS occupational group, as of February 6, 2002, who are appointed to another occupational group, leave the CRA or the public service will retain their acquired rights.

A *recognized postsecondary institution is defined as a Canadian public or private institution that is recognized or authorized to grant degrees, diplomas, and other credentials by a public or private act of the provincial/territorial legislature or through a government-mandated quality assurance mechanism. The institution must be listed in the Canadian Information Centre for International Credentials directory.

The courses for the specialization must be acceptable and must have been taken at a *recognized post-secondary institution, but not necessarily within a degree program in the required specialization.


Recent and significant* experience in 3 of the following 6:
1. Installation, maintenance and testing of computing environment (hardware, software, forensic techniques) and related equipment;
2. Analysis, evaluation, and deployment of computer systems and software proposed for implementation and in making recommendations (i.e. standalone computers, networked computers, servers, virtualization solutions, cloud solutions).
3. Providing guidance and technical assistance/support in resolving problems.
4. Troubleshooting issues encountered, on internal (computer software and hardware) and external digital devices and systems, including but not limited to large and complex networks, computers, servers, mobile devices, storage media, software, and other peripherals.
5. Application development in
• a high level language such as C/C++, Java, VB; or
• a scripting language such as Python, Perl, Ruby;or
• mobile device apps
6. digital forensic analysis of modern day operating systems (i.e. Microsoft Windows, Mac OS/X, Linux), and/or modern day mobile devices operating systems (i.e. Android, iOS, Microsoft Windows RT, Blackberry OS);

* Recent and significant experience is defined as experience normally acquired over 12 cumulative months in the last 3 years.

Candidates must have obtained the significant experience by the closing date of this notice. The onus is on the candidate to demonstrate that they meet the experience requirement. Insufficient information may result in your application not being given further consideration.

Please attach your experience submission to your online application.

The submission should be a maximum length of 2 pages (Font: times new romans, Font size: 12). Please indicate clearly how you meet the essential experience by providing examples, including the title of the position, and when and where you acquired the experience. It is not sufficient to simply state that the qualification is 'met' or to provide a listing of current or past responsibilities. A supervisor, who is able to validate the experience, is required for all experience provided.

Language Requirements


Staffing requirements to be assessed/applied

Any essential staffing requirements indicated below will be assessed/applied at a later date. Any discretionary staffing requirements indicated below may be applied/assessed at a later date.


1. Ability to communicate effectively in writing in English (written exam) - Pass mark 60%
2. Aptitude for Computer Forensics (written exam) - Pass mark 60%
3. *Ability to communicate orally, effectively in English (interview) Pass mark 60%

*Only candidates that pass the first two assessments will continue in the process and be invited to the 3rd assessment; interview.

Results from locally developed assessment tools may be used for appointment; however, they are not portable to other staffing processes except for the CS-02 Computer Forensic Analyst or for the CS-03 Senior Computer Forensic Analyst staffing processes being run concurrently in the Atlantic, Ontario and Pacific Regions. Candidates applying to both the CS-02 and CS-03 staffing processes in the same region OR to a CS-02 and/or CS-03 staffing process in another region can only write the locally developed assessment tools once.

Schedule for Candidate Assessment

The following are tentative assessment dates:

Examination – June/July, 2016
Interviews – June/July, 2016

Please note that testing may take place on weekend days.

Performance level:

The required performance levels for appointments from this staffing process are:

For temporary or permanent lateral moves:
Candidates must have achieved a performance level of 'Results mostly meet expectations' or level 2 or higher on the most recent finalized performance report.

For actings or permanent promotions:
Candidates must have achieved a performance level of 'Results meet expectations' or level 3 or higher on the most recent finalized performance report.

If a candidate doesn't have the required performance level, the candidate will not proceed further in the staffing process.

*If a candidate is not a Canada Revenue Agency employee, reasonable efforts will be made to confirm whether or not the candidate's performance is currently meeting expectations. This verification will be done through a reference check. If the candidate's performance is not currently meeting expectations, the candidate will not proceed further in the staffing process.

Asset (Discretionary)


1. Organizational Fit (reference check and interview) – Pass/Fail
2. Dependability (interview and reference check) Pass/Fail
3. Judgment (reference check) Pass/Fail


Extent of experience related to information technology/computers specifically in the areas listed under essential experience:

Additional education/training:

Computer Certifications:

CompTIA A+ Certification

CompTIA Network + Certification

Other computer related Certifications

Budget considerations
Employment Equity
Minimize business disruption

Conditions of Employment:
Travel Required
Valid Driver's License or personal mobility to a degree normally associated with the possession of a driver's license
Reliability/Security: Reliability +

General information

For information on how to apply, communication during the staffing process, foreign credentials, employment equity, accommodations during assessment, security status or clearance, and our code and conflict of interest requirements refer to the general information page

CRA employees are dedicated to serving in the public interest and have worked hard to earn the trust of Canadians. The Code of integrity and professional conduct and the Directive on conflict of interest, gifts and hospitality, and post-employment are important documents that outline the expected standards of conduct for CRA employees. We strongly recommend that you take the time to review these documents before you consider an employment opportunity with the CRA. Please note that a conflict of interest arises whenever an employee's private interests and/or outside activities impair, or could be perceived to impair, their ability to make decisions with integrity, impartiality, honesty, and in the best interests of the CRA and the Government of Canada.

The salary range is currently under review.

Before submitting an application, potential applicants are asked to carefully review the requirements of this job opportunity to determine if they are eligible to apply.

Applicants from the general public who do not meet the eligibility requirements in order to apply on this staffing process will not be considered and will not be contacted.

Applicants can view the status of their application by logging into their candidate profile on our Careers site.


We will create a pool of eligible candidates for this staffing process.

The closing date and time indicated on this notice of job opportunity may change; we may extend it if we do not have enough candidates apply or shorten it if we have a large number of candidates apply. We encourage you to submit your application as soon as possible.

We may give preference to the first 50 applications meeting the prerequisite requirements and consider more applications as needed. If you are considered further, we will notify you in writing of the next step in this staffing process.


Any expenses incurred by candidates from the general public in connection with this staffing process, will be borne by the candidates themselves.

Throughout the selection process, it is your responsibility to make yourself available for all testing and interview dates for which you are invited. If you fail to attend any of the scheduled testing or interview sessions, you will be deemed to be no longer interested in this selection process and as a result, you will not be considered further.

Veterans' Hiring Act (VHA)

The VHA allows current and honourably released former Canadian Forces (CF) members to continue serving Canadians by granting them access to employment opportunities within the federal public service. In order to be considered, these current and former CF members must have at least three years of service and must not already be permanently employed in the CRA or federal public service.

Current and honourably released former CF members applying to this staffing process are required to include the details of the Member's Personnel Record Resume (MPRR) or other official documents or pieces of identification (for example, a copy of their release letter), which are documents issued by the Department of National Defence (DND) with their application to confirm their eligibility to apply.

If the current or honourably released former CF member does not have a MPRR, he or she may contact Department of National Defence's Director of Casualty Support Management (DCSM) at 1(800) 883-6094 or for a copy of their MPRR or other official documents. For information on requesting a determination regarding status as a medically-released veteran, visit Veterans Affairs Canada.

Preferred Status

Before appointments are made from this staffing process, priority for appointment will be given to individuals with CRA preferred status. Members of the Canadian Forces released for medical reasons attributable to service will be given priority for appointment before all other individuals with CRA preferred status. Priority for appointment will be in the following order:

1. Members of the Canadian Forces released for medical reasons attributable to service with preferred status.
2. Individuals with either CRA surplus preferred status or CRA lay-off preferred status who live and/or work within the general rule of minimum distance of the position.
3. All other individuals with CRA preferred status who live and/or work within the general rule of minimum distance of the position.

Employment Equity

If Employment Equity is used as a staffing requirement to appoint from this staffing process, all candidates and all individuals with preferred status will have to meet the staffing requirements identified on this job posting in order to be considered for appointment.

Security Status/Clearance

An integral part of the Personnel Screening Program requires that all candidates being appointed into the CRA be subject to a reliability check. This includes the verification of reliability, employment history, and police records and will include fingerprinting. The Personnel Screening Program was implemented to protect information that is departmentally sensitive or sensitive to the national interest by ensuring that all persons engaged by CRA meet standards of reliability, trustworthiness and loyalty required by the nature of their duties or tasks.

When attending any tests and/or interview sessions, candidates may be required to complete Personnel Screening forms so that a reliability check can be conducted. When completing the personnel security clearance form, you will be required to provide complete addresses for the places you resided in the last FIVE YEARS, including the year(s) and month(s) for each residence. If you were residing outside of Canada in the last five years, you may experience a delay in obtaining a security status/clearance.

In addition, candidates may be required to provide the original and photocopies of two of the documents listed below. Please note that one must be a photo ID. Photocopying services will not be provided.

• Valid Canadian passport
• Other passports with a Certificate of Citizenship or Permanent Resident card
• Birth Certificate
• Baptismal Certificate
• Valid Canadian driver's license
• Federal Public Service issued ID card

NOTE: If you were residing outside of Canada in the last five years, you may experience a delay in obtaining a Reliability Status. You will be required to provide a valid, certified true copy, both sides, of one of the following:

• (Canadian) Permanent Resident Card, or
• Canadian Citizenship certificate, or
• Certificate(s) issued by local police authorities in Canada or from countries of origin (where you have resided in the last five years)

If you have been employed by CRA within the last year and have a valid Reliability Status you are not required to complete the security forms or bring photocopies.

Reliability Status + is a new level of personnel security screening incorporating enhanced verifications for certain positions within the Agency. For this position, the following additional verifications will be conducted in addition to the existing Reliability Status security level screening process:

• Law Enforcement Records Check
• Credit Check
• Tax Compliance Verifications

Reliability Status Plus must be successfully obtained to be considered for the position.

McNeil Policy

Applicants should be aware of the following court decision The Supreme Court of Canada decision in R. v. McNeil imposed a legal duty on the Crown to disclose to the accused, acts of serious misconduct or criminal records of potential crown witnesses that either (1) are relevant to the investigation or (2) could reasonably impact on the case against the accused. The CRA recognizes this obligation to provide the Crown with records relating to such findings that could affect the credibility of the employee as a witness in the case against the accused. The onus is on any CRA employee involved in a criminal investigation, as a witness, to make the Public Prosecution Service of Canada (PPSC) aware, in writing, of all items covered by this policy.


Before proceeding with appointments from this staffing process, the manager will give priority for appointment to individuals with CRA preferred status.

Appointments made from this staffing process will be based on one or more of the staffing requirement(s) identified on this notice.


Email Address:

Return to: Search jobs
Screen ID: