My Path to Progression: Legal Advisor to Forensic Investigator

Through our Path to Progression blog series, we’re sharing colleague stories about how they’ve developed, changed and grown their career within NCC Group. For the fifth installment of our series, our Talent Attraction team spoke to Michael Alexander Heenes from our Dutch team to hear more about his journey so far and how progressed from Legal Counsel to Senior Forensic Investigator at Fox-IT.

Can you tell us about your background and first role at NCC Group?

I’m Michael Heenes, and I’ve started in September 2020 as a Legal Counsel at Fox-IT/ NCC Group.

I studied law at the Universiteit Leiden in the Netherlands, but I always wanted to go abroad, so I did a part of my degree in Austin, Texas USA. I met a brilliant professor there, prof. Craig Ball, who is both trial lawyer and computer forensic examiner. Besides teaching, he provides advice and expertise about digital forensic evidence as part of legal cases in court. He had some great war stories about how he found the juicy evidence he needed to win his cases. His stories touched and inspired me, so when I came home and finished my Masters in Civil Procedure and Evidence Law, I decided to also pick up a Bachelors in IT Forensics. As I finished my second degree in 2020, I very quickly found my way to the legal department at Fox-IT as my background was an interesting one – legal and IT.

When first joining Fox-IT, I did a corporate legal assignment – think non-disclosure agreements, compliance reviews and checking general terms and conditions for partners and clients. But just short of a year later, I felt this wasn’t entirely what I was looking for. I did some work for the forensics and incident response department – which I found extremely exciting and wanted to do more often.

When did you start to look for a new role and what was the process?

I started to look around for something else with more connection to the IT bachelor’s degree I did. I talked to my manager, who was really great and supporting, and he advised me to look around in the company and interview people, to try to find my spot. I talked to the FIR (Forensics and Incident Response) department team members, and the team lead. We had a great chat, and she advised me to do a technical assessment. HR obstacles weren’t there at all, it was great to feel the freedom that I could do whatever interested me really, just there, right within the company.

I did a little brush-up before my assessment (during the 10 months I’ve worked as a Legal Counsel, my Linux knowledge among others became somewhat faded). Command line work, manually mounting forensic images, using forensic tooling, that kind of stuff. I had no idea what to expect to be honest. Our FIR lead assured me that, even if my assessment was terrible, I could still work my way up with coaching and internal trainings. That took away some of the weight on my shoulder – I really wanted to make it work!

Not needing to stress, I did well on the assessment and I earned my spot at FIR. My preference was always to stay at Fox-IT as I was beginning to understand the internal procedures and really liked the people I worked with, so I was thrilled to be given the opportunity.

What is your current role?

My current role is “Senior Consultant”, more specifically, a senior forensic investigator. My everyday work is quite varied. It ranges from investigating fraud to assisting clients with ransomware attacks. Other tasks include doing intakes, delivering our eDiscovery services, onboarding new IR clients, and giving training sessions on behalf of the Fox-IT Academy. In our First Responder training, for example, I teach clients to be part of their company’s “digital fire brigade”, how to deal with forensic evidence and how to keep your head cool during an incident.

I find it truly satisfying to help our clients with their legal forensic questions. What can we do for them when they suspect an employee is stealing intellectual property or breaching a confidentiality clause? What is the evidentiary value of our reports and how do they go about in legal proceedings? Clients struggle with these issues, and it is these moments where I can touch upon the area where law and digital forensics meet. Every now and then I answer legal questions on the floor too, ranging from assessing our privacy code of conduct for private investigators to reformulating a report such that it prevents ambiguity and unwanted legal meaning. If the questions are complex or have a significant impact, I always forward them to our Legal Department.

Where do you see yourself in the future at Fox-IT/NCC Group?

I have a lot of ideas and dreams for the future. By setting up an elaborate training program, I would like to teach legal professionals such as judges, lawyers, bailiffs (etc.) where to find digital evidence, how to make sense of it, and how to defend the evidence in court. I also want to see Fox-IT becoming the leading firm in the seizure of digital evidence. In a legal case, digital evidence might need to be preserved in a very early stage to prevent tampering or destruction. We might, for instance, seize laptops, servers or copy documents, photos, and other evidence for safekeeping. We are currently productizing this service so we can help our clients all over the Benelux. More updates are soon to follow.

For people who are looking for something else to do – my advice is: stay right where you are and explore. Talk to people, discover what others are doing. At Fox-IT, people want you to explore different roles in Cyber Security. It might be a much easier transition than starting somewhere else, completely from scratch. And if you want to work in forensics, reach out to me! Even if you don’t work for Fox-IT.