{
  "id": "role:forensic-analyst",
  "_kind": "Role",
  "_file": "role/roles/roles-expanded-2.yaml",
  "_cluster": "role",
  "attributes": {
    "displayName": "Digital Forensic Analyst",
    "isAgentic": false,
    "requiredCapabilities": [],
    "requiredDomains": [],
    "description": "Conducts digital forensic investigations — disk imaging, memory\nanalysis, log reconstruction, malware analysis, and chain-of-custody\ndocumentation for legal proceedings.\n"
  },
  "outgoingEdges": [
    {
      "from": "role:forensic-analyst",
      "to": "responsibility:security-audit",
      "kind": "holds_responsibility"
    },
    {
      "from": "role:forensic-analyst",
      "to": "responsibility:incident-response",
      "kind": "holds_responsibility"
    },
    {
      "from": "role:forensic-analyst",
      "to": "skill-area:incident-response-forensics",
      "kind": "requires_expertise",
      "attributes": {}
    },
    {
      "from": "role:forensic-analyst",
      "to": "skill-area:endpoint-security-edr",
      "kind": "requires_expertise",
      "attributes": {}
    },
    {
      "from": "role:forensic-analyst",
      "to": "domain:cybersecurity",
      "kind": "applies_to",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}