CSIS Digital Forensic Investigator
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Use - for any list of duties/requirements/benefits, and
for prose. Do NOT repeat job title as heading. Do NOT put Job ID/requisition numbers as headings. Preserve all substantive info; remove boilerplate, navigation, legal, EEO, equal-opportunity, scam-warning, duplicated lines, application instructions. Include a section only when posting has real specific content for it; never emit heading followed by filler/placeholder text. Prefer few substantive sections over many thin ones.
We need to parse the posting.
Key content:
- Intro paragraph: "The CSIS Lead Investigator is a strategic professional who stays abreast of developments within own field and contributes to directional strategy by considering their application in own job and the business. Recognized technical authority for an area within the business. Requires basic commercial awareness. There are typically multiple people within the business that provide the same level of subject matter expertise. Developed communication and diplomacy skills are required in order to guide, influence and convince others, in particular colleagues in other areas and occasional external customers. Significant impact on the area through complex deliverables. Provides advice and counsel related to the technology or operations of the business. Work impacts an entire area, which eventually affects the overall performance and effectiveness of the sub-function/job family."
That's about the role.
- Responsibilities: list of duties (multiple sentences). We'll need to extract bullet points.
Responsibilities block:
"An Investigator will be responsible for the coordination and investigation of high level fraud matters and/or network security incidents
This role will utilize sophisticated expertise in investigative interviewing, fraud identification, loss prevention, network security, cyber enabled fraud, to identify fraud activities, schemes, trends and organized rings that create a risk to our firm, its employees, shareholders, systems, assets and clients
Conduct proactive, complex, variable and high profile/sensitive investigations with the goal of developing cases to a successful conclusion and providing timely fraud preventive intelligence to business and functional partners
Actively engage partners and management to ensure they are kept apprised of any significant changes during the progress of an investigation
Responsible for the recovery of losses through court ordered restitution, property or direct payment by suspects
Build external relationships with members of law enforcement, industry peers and other sources of support
Engage with internal and external suspects, witnesses and third parties through interview and interrogation, evidence collection and forensic examination
Represent Citi in criminal and civil court matters and have the ability to show knowledge and provide accurate and supportive testimony
Mentor and train junior staff members
Brief others on an ongoing investigations/investigative projects
Has the ability to operate with a limited level of direct supervision. Can exercise independence of judgement and autonomy. Acts as SME to senior stakeholders and /or other team members.
Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency."
We can turn each sentence into
- .
- Qualifications: list:
"6-10 years of experience
Ability to conduct investigative interviews and recording techniques that tie the facts and evidence together
Experience investigating complex and variable case(s) that has substantial impact
Understanding of forensic and eDiscovery processes and procedures to include the collection, examination, and analysis of data while preserving integrity and maintaining a strict chain of custody
Experience representing/testifying in criminal and civil court matters
Conveys mastery of investigative concepts
Demonstrated report writing that would present the case and evidences gathered in a cohesive and comprehensive manner
Knowledge of financial products, frauds and trends
Previous US Intelligence, military, law enforcement, law firm or government service background
Experience working in an in-house investigations team
Professional certifications (GCFE, GCFA, or equivalent)
Proficiency in Microsoft Office products - Word, Excel, Outlook, PowerPoint, & SharePoint for compiling written reports and spreadsheets on an investigation
Flexibility to work on call off hours/weekends during critical project phases, if necessary
Education: Bachelors degree, potentially Masters degree"
We can treat as list.
- Knowledge and Skills Required: list:
"Computer forensics experience with knowledge of Windows and Linux operating systems and their file systems.
Experience conducting various system log analysis, such as Proxy logs, Window event logs, Purview and firewall logs.
Experience with various standard forensic acquisition and analysis suites, such as Encase, Axiom, FTK, and Cellebrite.
Excellent communication for conducting case work and obtaining cooperation of other parties.
An ability to multi-task, demonstrated attention to detail with ability to manage caseload and produce accurate, concise analytical reports.
Expresses ideas or facts in a clear, concise, and open manner"
- Knowledge And Skills Preferred: list:
"Knowledge of enterprise cloud computing environments (AWS, Azure, GCP) and associated security controls.
Knowledge in utilizing Log Aggregation tools (Splunk) and the ability to query and analyze large datasets.
Experience in Memory forensics, analyzing volatile memory detecting hiding processes, and rootkits.
Experience in Network analysis investigating network connections and active sockets to identify various communication channels.
Experience is utilizing various open-source forensic tools such as: (Autopsy, Volatility, and Wireshark)
Experience in Automation and Scripting developing custom scripts utilizing Python and PowerShell to automate artifact collection and log parsing."
- Pay: "Primary Location Full Time Salary Range: $114,720.00 - $172,080.00 In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards."
- Benefits: "Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs. Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays."
- Schedule: Not explicitly given. There's "Flexibility to work on call off hours/weekends during critical project phases, if necessary" but that's under qualifications. No explicit schedule like full-time, part-time, shift. There's "Time Type: Full time" earlier. So we have schedule: Full time. Should we include a Schedule section? The posting includes "Time Type: Full time". That's schedule info. So we can include Schedule section with that.
- Location: "Primary Location: Irving Texas United States". Could be included maybe as a short paragraph under About the role or separate? The instruction says we can include sections only when posting has real specific content. Location is metadata; we could fold into a short
maybe under About the role or separate. But we should not create a heading for location unless we have a section like "Location". Not required. We can include location in a paragraph under About the role or as a separate
before sections. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." So we can include location in a short
.
- Also "Job Family Group: Corporate Services", "Job Family: Investigations". Could be folded similarly.
We need to avoid boilerplate: remove lines like "Most Relevant Skills Please see the requirements listed above." "Other Relevant Skills For complementary skills, please see above and/or contact the recruiter." "Anticipated Posting Close Date: Sep 23, 2026" maybe not needed? It's metadata but could be folded into short
. However it's not a section heading; we can include as a short paragraph.
"Automated Processing and AI ..." is boilerplate (legal). Remove.
"Citi is an equal opportunity employer..." remove EEO boilerplate.
Thus final HTML fragment will have sections: About the role (maybe as
About the role
), Responsibilities (Responsibilities
), Qualifications (Qualifications
), Knowledge and Skills Required (Knowledge and Skills Required
), Knowledge and Skills Preferred (Knowledge and Skills Preferred
), Pay (Pay
), Benefits (Benefits
), Schedule (Schedule
). Possibly also combine Knowledge and Skills Required and Preferred into one Skills section? But instruction: prefer few substantive sections over many thin ones. However we have distinct content; we could combine Required and Preferred into a single Skills section with subheadings? But we cannot use headings other than for section headings. Could we embed inside? Probably okay but better to keep separate if they are substantive. However we could merge them into one Skills section with two lists: Required and Preferred. That would reduce number of sections. Let's consider: The posting has both Required and Preferred; we could make a Skills section with two sub-lists labeled with Required:
etc. That would be acceptable.
Thus sections: About the role, Responsibilities, Qualifications, Skills, Pay, Benefits, Schedule.
We need to ensure we don't include filler like "commensurate with experience". Not present.
Now craft HTML.
We'll start with a short paragraph for metadata: location, job family, job family group, time type, posting close date maybe.
But we should not repeat job title. So we can do:
Location: Irving, Texas, United States
Job Family Group: Corporate Services
Job Family: Investigations
Time Type: Full time
Posting Close Date: September 23, 2026
That's minor metadata.
Then sections.
Now produce HTML.
Make sure to use - for lists.
Let's draft.
About the role paragraph: combine the intro sentences into one or two
. Could be multiple
but okay.
We'll produce:
About the role
The CSIS Lead Investigator is a strategic professional who stays abreast of developments within own field and contributes to directional strategy by considering their application in own job and the business. Recognized technical authority for an area within the business. Requires basic commercial awareness. There are typically multiple people within the business that provide the same level of subject matter expertise. Developed communication and diplomacy skills are required in order to guide, influence and convince others, in particular colleagues in other areas and occasional external customers. Significant impact on the area through complex deliverables. Provides advice and counsel related to the technology or operations of the business. Work impacts an entire area, which eventually affects the overall performance and effectiveness of the sub-function/job family.
Now Responsibilities:
Responsibilities
- Coordinate and investigate high-level fraud matters and/or network security incidents.
- Utilize sophisticated expertise in investigative interviewing, fraud identification, loss prevention, network security, and cyber-enabled fraud to identify fraud activities, schemes, trends, and organized rings that create risk to the firm, its employees, shareholders, systems, assets, and clients.
- Conduct proactive, complex, variable, and high-profile/sensitive investigations with the goal of developing cases to a successful conclusion and providing timely fraud preventive intelligence to business and functional partners.
- Actively engage partners and management to ensure they are kept apprised of any significant changes during the progress of an investigation.
- Responsible for the recovery of losses through court-ordered restitution, property, or direct payment by suspects.
- Build external relationships with members of law enforcement, industry peers, and other sources of support.
- Engage with internal and external suspects, witnesses, and
for prose. Do NOT repeat job title as heading. Do NOT put Job ID/requisition numbers as headings. Preserve all substantive info; remove boilerplate, navigation, legal, EEO, equal-opportunity, scam-warning, duplicated lines, application instructions. Include a section only when posting has real specific content for it; never emit heading followed by filler/placeholder text. Prefer few substantive sections over many thin ones. We need to parse the posting. Key content: - Intro paragraph: "The CSIS Lead Investigator is a strategic professional who stays abreast of developments within own field and contributes to directional strategy by considering their application in own job and the business. Recognized technical authority for an area within the business. Requires basic commercial awareness. There are typically multiple people within the business that provide the same level of subject matter expertise. Developed communication and diplomacy skills are required in order to guide, influence and convince others, in particular colleagues in other areas and occasional external customers. Significant impact on the area through complex deliverables. Provides advice and counsel related to the technology or operations of the business. Work impacts an entire area, which eventually affects the overall performance and effectiveness of the sub-function/job family." That's about the role. - Responsibilities: list of duties (multiple sentences). We'll need to extract bullet points. Responsibilities block: "An Investigator will be responsible for the coordination and investigation of high level fraud matters and/or network security incidents This role will utilize sophisticated expertise in investigative interviewing, fraud identification, loss prevention, network security, cyber enabled fraud, to identify fraud activities, schemes, trends and organized rings that create a risk to our firm, its employees, shareholders, systems, assets and clients Conduct proactive, complex, variable and high profile/sensitive investigations with the goal of developing cases to a successful conclusion and providing timely fraud preventive intelligence to business and functional partners Actively engage partners and management to ensure they are kept apprised of any significant changes during the progress of an investigation Responsible for the recovery of losses through court ordered restitution, property or direct payment by suspects Build external relationships with members of law enforcement, industry peers and other sources of support Engage with internal and external suspects, witnesses and third parties through interview and interrogation, evidence collection and forensic examination Represent Citi in criminal and civil court matters and have the ability to show knowledge and provide accurate and supportive testimony Mentor and train junior staff members Brief others on an ongoing investigations/investigative projects Has the ability to operate with a limited level of direct supervision. Can exercise independence of judgement and autonomy. Acts as SME to senior stakeholders and /or other team members. Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency." We can turn each sentence into
maybe under About the role or separate. But we should not create a heading for location unless we have a section like "Location". Not required. We can include location in a paragraph under About the role or as a separate
before sections. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." So we can include location in a short
. - Also "Job Family Group: Corporate Services", "Job Family: Investigations". Could be folded similarly. We need to avoid boilerplate: remove lines like "Most Relevant Skills Please see the requirements listed above." "Other Relevant Skills For complementary skills, please see above and/or contact the recruiter." "Anticipated Posting Close Date: Sep 23, 2026" maybe not needed? It's metadata but could be folded into short
. However it's not a section heading; we can include as a short paragraph. "Automated Processing and AI ..." is boilerplate (legal). Remove. "Citi is an equal opportunity employer..." remove EEO boilerplate. Thus final HTML fragment will have sections: About the role (maybe as
About the role
), Responsibilities (Responsibilities
), Qualifications (Qualifications
), Knowledge and Skills Required (Knowledge and Skills Required
), Knowledge and Skills Preferred (Knowledge and Skills Preferred
), Pay (Pay
), Benefits (Benefits
), Schedule (Schedule
). Possibly also combine Knowledge and Skills Required and Preferred into one Skills section? But instruction: prefer few substantive sections over many thin ones. However we have distinct content; we could combine Required and Preferred into a single Skills section with subheadings? But we cannot use headings other than for section headings. Could we embed inside? Probably okay but better to keep separate if they are substantive. However we could merge them into one Skills section with two lists: Required and Preferred. That would reduce number of sections. Let's consider: The posting has both Required and Preferred; we could make a Skills section with two sub-lists labeled with Required:
etc. That would be acceptable.
Thus sections: About the role, Responsibilities, Qualifications, Skills, Pay, Benefits, Schedule.
We need to ensure we don't include filler like "commensurate with experience". Not present.
Now craft HTML.
We'll start with a short paragraph for metadata: location, job family, job family group, time type, posting close date maybe.
But we should not repeat job title. So we can do:
Location: Irving, Texas, United States
Job Family Group: Corporate Services
Job Family: Investigations
Time Type: Full time
Posting Close Date: September 23, 2026
That's minor metadata.
Then sections.
Now produce HTML.
Make sure to use - for lists.
Let's draft.
About the role paragraph: combine the intro sentences into one or two
. Could be multiple
but okay.
We'll produce:
About the role
The CSIS Lead Investigator is a strategic professional who stays abreast of developments within own field and contributes to directional strategy by considering their application in own job and the business. Recognized technical authority for an area within the business. Requires basic commercial awareness. There are typically multiple people within the business that provide the same level of subject matter expertise. Developed communication and diplomacy skills are required in order to guide, influence and convince others, in particular colleagues in other areas and occasional external customers. Significant impact on the area through complex deliverables. Provides advice and counsel related to the technology or operations of the business. Work impacts an entire area, which eventually affects the overall performance and effectiveness of the sub-function/job family.
Now Responsibilities:
Responsibilities
- Coordinate and investigate high-level fraud matters and/or network security incidents.
- Utilize sophisticated expertise in investigative interviewing, fraud identification, loss prevention, network security, and cyber-enabled fraud to identify fraud activities, schemes, trends, and organized rings that create risk to the firm, its employees, shareholders, systems, assets, and clients.
- Conduct proactive, complex, variable, and high-profile/sensitive investigations with the goal of developing cases to a successful conclusion and providing timely fraud preventive intelligence to business and functional partners.
- Actively engage partners and management to ensure they are kept apprised of any significant changes during the progress of an investigation.
- Responsible for the recovery of losses through court-ordered restitution, property, or direct payment by suspects.
- Build external relationships with members of law enforcement, industry peers, and other sources of support.
- Engage with internal and external suspects, witnesses, and
. Could be multiple
but okay. We'll produce:
About the role
The CSIS Lead Investigator is a strategic professional who stays abreast of developments within own field and contributes to directional strategy by considering their application in own job and the business. Recognized technical authority for an area within the business. Requires basic commercial awareness. There are typically multiple people within the business that provide the same level of subject matter expertise. Developed communication and diplomacy skills are required in order to guide, influence and convince others, in particular colleagues in other areas and occasional external customers. Significant impact on the area through complex deliverables. Provides advice and counsel related to the technology or operations of the business. Work impacts an entire area, which eventually affects the overall performance and effectiveness of the sub-function/job family.
Now Responsibilities:Responsibilities
- Coordinate and investigate high-level fraud matters and/or network security incidents.
- Utilize sophisticated expertise in investigative interviewing, fraud identification, loss prevention, network security, and cyber-enabled fraud to identify fraud activities, schemes, trends, and organized rings that create risk to the firm, its employees, shareholders, systems, assets, and clients.
- Conduct proactive, complex, variable, and high-profile/sensitive investigations with the goal of developing cases to a successful conclusion and providing timely fraud preventive intelligence to business and functional partners.
- Actively engage partners and management to ensure they are kept apprised of any significant changes during the progress of an investigation.
- Responsible for the recovery of losses through court-ordered restitution, property, or direct payment by suspects.
- Build external relationships with members of law enforcement, industry peers, and other sources of support.
- Engage with internal and external suspects, witnesses, and