Department of the Air Force

Criminal Investigator (Cyber)

Salt Lake City, Utah, Seattle, Washington, Phoenix, Arizona, Los Angeles, California, San Francisco, Full time

Criminal Investigator (Cyber)

Department: Department of the Air Force

Location(s): Salt Lake City, Utah, Seattle, Washington, Phoenix, Arizona, Los Angeles, California, San Francisco, California, Denver, Colorado, Washington, District of Columbia, Miami, Florida, Atlanta, Georgia, Chicago, Illinois, Indianapolis, Indiana, New Orleans, Louisiana, Boston, Massachusetts, Minneapolis, Minnesota, Kansas City, Missouri, Albuquerque, New Mexico, New York, New York, Oklahoma City, Oklahoma, Portland, Oregon, Austin, Texas

Salary Range: $105383 - $137000 Per Year

Job Summary: The U.S. Air Force Office of Special Investigations (AFOSI) is seeking talented individuals to serve as Special Agents, protecting the U.S. Air Force and Space Force as its dedicated federal law enforcement and counterintelligence agency. With a global presence, AFOSI investigates felony-level crimes, combats fraud, conducts counterintelligence operations, and provides personal protection, partnering with various agencies to safeguard our nation's people and assets.

Major Duties:

  • Limiting Number of Applicants: It is recommended that you apply as soon as possible in order to receive consideration as this announcement will close on November 20, 2025 11:59 p.m. ET or on the day we receive 50 applicants (whichever comes first.) This position starts at a salary of $105,383 (GS-13, Step 1) to $137,000 GS-13, Step 10). The salary listed reflects the "Rest of U.S." scale and, if applicable, will be adjusted to meet the locality pay or cost of living expenses of the duty location upon selection. This announcement will be utilized to fill Criminal Investigator, GS-1811-13, positions with a specialty in Cyber investigations. While potential duty locations are provided below, the agency retains the flexibility to fill positions at other locations based on mission requirements. You will be asked to indicate your desired location preferences in the announcement questionnaire; however, assignment to a preferred location is not assured. Potential duty locations may include, but are not limited to: JBSA Lackland AFB, TX Duties require use of a mastery of the theories, concepts, principles, practices, laws, and regulations of criminal investigations including constitutional, international, and statutory laws. As a senior criminal investigator, independently plans, organizes, and conducts extremely difficult and complex criminal investigations. Develops criminal investigative reports upon completion of each assignment for use in facilitating determination of appropriate actions and final decisions. Coordinates criminal investigative activity with other federal, state, and local law enforcement agencies such as the Federal Bureau of Investigation (FBI), US Army Criminal Investigation Command (USACIDC), Naval Criminal Investigative Service (NCIS), Defense Criminal Investigative Service (DCIS), US Attorney, or foreign governments on matters related to criminal investigations. Provides expert technical advice, guidance, and recommendations to senior DOD and AF management, investigative personnel, attorneys, and other interested parties on criminal investigative matters.

Qualifications: To qualify, applicants must have fifty-two (52) weeks of full time specialized or equivalent specialized experience at a level of difficulty and responsibility equivalent to the GS-12 grade level (or equivalent in other pay systems) in the Federal service. Specialized Experience: GS-12 level specialized experience required for this position includes: Planning and conducting highly complex criminal investigations, independently as a lead investigator or as a team member Apprehending or detaining suspected violators of criminal laws of the U.S. Conducting interviews with suspects, witnesses, and informants in case development Recruiting and utilizing witnesses Planning, organizing, and conducting surveillance Preparing interim and comprehensive final investigative reports for prosecutors and management officials Participating in joint task forces Briefing management and DoD officials on the progress of current investigations Testifying before Grand Juries, proceedings in criminal trials, and/or administrative hearings Coordinating criminal investigative activity with other Federal, state, and local agencies and foreign governments and resolving jurisdictional issues Equivalent specialized experience: GS-12 equivalent specialized experience required for this position includes one or more of the following: 1) Criminal investigative expertise and/or other felony-level criminal investigative expertise, gained from experience in federal law enforcement criminal investigations. 2) Tactical operational expertise in law enforcement relevant to criminal investigations associated with unauthorized network access or advanced persistent threat operations, gained from experience in Department of Defense and/or federal law enforcement. Such experience could include penetration testing, proactive hunt operations, information operations, digital forensics, cyber enabled fraud, and other related disciplines. Network defense experience may also be qualifying, depending on the training and experience. 3) Cybersecurity expertise, gained from the private sector (e.g. incident response, Chief Information Security Officer, risk consulting, finance, etc.), the US military and/or the US Intelligence Community. 4) Counterintelligence expertise, gained from experience in a US government counterintelligence role, to include analysis, functional services, collections, investigations and operations. Applicants should make note of any blended cyber counterintelligence experience. Additional Training and Experience: Highly desired applicants will have current industry standard (or DoD Equivalent) certification portfolio that demonstrates an emphasis on cyber investigations and operations techniques. Examples of such certifications include; DoD Computer Crime Investigator; Vendor-based computer forensic certification, such as EnCase Certified Examiner (EnCE) or Access Data Certified Examiner (ACE); Non-vendor computer forensic certification such as IACIS Certified Forensic Computer Examiner (CFCE), ISFCE Certified Computer Examiner (CCE) or GIAC Certified Forensic Examiner (GCFE); CompTIA certifications A+, Net+, and Sec+, or PenTest+; Offensive Security Certified Professional (OSCP); GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), GIAC Penetration Tester (GPEN), GIAC Defending Advanced Threats (GDAT); or computer science degree with associated investigative experience. Highly desired applicants may also possess certifications relevant to cybersecurity in DoD, US Intelligence Community, and private sector settings. Such relevant certifications include, but are not limited to, Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Applicants may also detail other cybersecurity certifications not listed here for consideration. PART-TIME OR UNPAID EXPERIENCE: Credit will be given for appropriate unpaid and or part-time work. You must clearly identify the duties and responsibilities in each position held and the total number of hours per week. OTHER SIGNIFICANT FACTS EMERGENCY ESSENTIAL PERSONNEL/POSITIONS: This position may be Emergency-Essential (E-E). The incumbent of this position must meet all requirements of E-E positions and may be required as a condition of employment to take a series of vaccinations and annual boosters to immunize against anthrax and other diseases. In the event of a crisis situation, the incumbent or designated alternate must continue to perform the E-E duties until relieved by proper authority. The incumbent or the designated alternate may be required to take part in readiness exercises. The incumbent, as a condition of employment, may be reassigned to any to any geographic location where AFOSI personnel may be assigned and/or required to deploy to support the success of combat operations or the availability of combat essential systems. Failure to deploy may subject the incumbent to administrative action. This position cannot be vacated during a national emergency or mobilization without seriously impairing the capability of the organization to function effectively. Incumbent will be required to sign and acknowledge their understanding of these requirements. Due to the mission essential nature of EE positions, concurrent membership in the military reserves could conflict with the performance of these duties. If you are selected for an EE position and are also an active reservist, you will be required to transfer to an inactive or standby status or resign/retire from the reserves prior to your appointment. Law Enforcement Availability Pay (LEAP): LEAP compensates Criminal Investigators for substantial amounts of unscheduled overtime or their availability to work substantial amounts of overtime. Applicants are eligible to receive LEAP upon appointment. To ensure your availability, you will receive extra compensation in the form of LEAP, which is calculated at a flat rate of 25 percent of basic pay (including applicable locality pay). Lautenberg Amendment: This position is covered by the Domestic Violence Misdemeanor Amendment (30 Sep 96) of the Gun Control Act (Lautenberg Amendment) of 1968, the following standard statement should be added under Other Significant Facts of the SCPD: Position requires access to firearms. Persons convicted of a misdemeanor or felony crime of domestic violence may not occupy this position in accordance with the Gun Control Act of 1968, as amended 30 Sep 96. Employee must sign DD Form 2760, Qualification to Possess Firearms or Ammunition. Key Position: This position may be designated as a key position IAW AFI 36-507. Duties of this position are essential to the accomplishment of wartime/contingency operations. Incumbents of key positions must be removed from their military recall status if alternative for filling of the position during an emergency are not available. Mission Essential: This position may be Mission Essential (ME) position performing a Mission Critical Function (MCF) which must continue uninterrupted after the occurrence of an emergency and continued through full resumption of all functions. IAW, DoDI 3020-42, Defense Continuity Programs.

How to Apply: DESCRIBING YOUR EXPERIENCE: PLEASE BE CLEAR AND SPECIFIC. WE WILL NOT MAKE ASSUMPTIONS REGARDING YOUR EXPERIENCE. To begin the process, click the Apply Online button to create an account or log in to your existing USAJOBS account. Follow the prompts to complete the application questionnaire. Please ensure you click the Submit My Application button at the end of the process. To preview the Application Questionnaire, please click on the following link: https://apply.usastaffing.gov/ViewQuestionnaire/12836046 If your resume/application does not support your Assessment Questionnaire answers, we will not allow credit for your response(s). Your resume must contain sufficiently detailed information upon which to make a qualification determination. The two-page resume ensures the most relevant experience is reviewed and considered, which is a common practice in both the public and private sectors. Resumes exceeding two pages will be removed from consideration. Additional information on how to complete or update your resume may be located here. For qualification determination your resume must contain hours worked per week and dates of employment (i.e., month/year to month/year or month/year to present). If your resume does not contain this information, your application may be marked as insufficient, and you will not receive consideration for this position. If you are a current Federal employee or previous Federal employee, provide your pay plan, series, and grade, i.e., GS-0301-09. Current Federal Civilian Employees may list any relevant performance related rating (given within the last three years) and/or incentive awards in your resume. Do NOT include photographs (or links to social media such as LinkedIn), inappropriate material, inappropriate content, nor personal information such as age, gender, religion, social security number, etc., on your resume. If the resume you submit contains such information you will not be considered for this vacancy. Your name, first and last, MUST be included on your resume.

Application Deadline: 2025-11-20