Cryptologist

Peraton is seeking a Cryptologist in our Linthicum, MD office in support of our Department of Defense (DoD) customer as part of a highly talented, highly motivated, and high-performing team. This position offers a unique opportunity to work at the forefront of cyber investigations, digital forensics, cyber threat analysis, and mission support in a dynamic and collaborative environment. The successful candidate will contribute to protecting national security interests by leveraging technical expertise, analytical skills, and innovative problem-solving to address complex cyber challenges. Individuals who are passionate about cybersecurity, committed to excellence, and eager to make a meaningful impact are encouraged to apply.

This highly analytical Cryptologist should specialize in data recovery and device access to directly support law enforcement, counterintelligence (CI) investigations, and digital forensic examiners. You will serve as a critical technical resource for investigative teams — recovering encrypted, deleted, and otherwise inaccessible data from seized devices and digital media encountered during active criminal and CI investigations. Core responsibilities include:

• Decrypting encrypted data from mobile devices, computers, and storage media
• Recovering deleted data not recognized by standard carving tools
• Extracting data from flash memory chips with custom or proprietary file systems
• Collaborating with digital forensic examiners to support evidence recovery from locked or damaged devices
• Researching encryption implementations and storage architectures used in consumer and commercial devices to identify recovery pathways
• Producing detailed technical reports documenting methodologies and findings suitable for federal court proceedings or intelligence products

This position requires full-time, onsite attendance Monday through Friday in the Baltimore metropolitan area. 

#DC3bonus

Required Qualifications

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD; Additional four years of experience may be considered in lieu of a BS/BA degree. A degree in Mathematics, Computer Science, Cryptography, Information Security, or a related field is highly desired.
• Active TS clearance, SCI eligible.
• Strong programming and scripting proficiency in Python, C++, Java, or similar languages.
• Experience decrypting data from encrypted mobile devices (Android/iOS), full-disk encryption (FDE), and file/container-level encryption schemes.
• Experience recovering deleted or fragmented data beyond the capabilities of standard forensic carving tools
• Experience extracting data from NAND/NOR flash memory chips, including devices with custom or proprietary file systems.
• Familiarity with digital forensic tools and workflows (e.g., Cellebrite, GrayKey, Magnet AXIOM, EnCase, FTK, X-Ways)
• Low-level knowledge of common file systems including FAT, NTFS, EXT2/3/4, APFS, and proprietary embedded file systems.
• Experience supporting law enforcement, CI, or federal investigative operations.

Desired Qualifications

• Experience with hardware-based data recovery techniques including JTAG, chip-off, and ISP (In-System Programming).
• Background in reverse engineering storage protocols, firmware, or encryption implementations on embedded devices.
• Familiarity with legal frameworks governing lawful access and chain-of-custody requirements for recovered data.
• Prior experience supporting DoD, Intelligence Community (IC), or federal law enforcement customers (FBI, DEA, HSI, NCIS, etc.).
• Experience testifying as an expert witness or providing technical declarations in federal proceedings.