Deepfake Detection Analyst Job Description

A Deepfake Detection Analyst answers one question about a piece of media: is this what it claims to be? The file might be a selfie video submitted to open a bank account, a voice note that sounds like the chief financial officer approving a wire, a clip spreading fast the week before an election, or an intimate image that a user says was fabricated. The analyst decides whether the content is an authentic capture, an edited original or wholly synthetic, then writes the finding down in a form someone else can act on.

The job sits wherever a wrong call is expensive. On fraud and identity teams at banks, fintechs and verification vendors, the analyst reviews onboarding documents, liveness checks and recorded calls. On trust-and-safety teams at social, messaging and video platforms, the analyst takes the hard cases that automated filters cannot settle, especially non-consensual synthetic imagery and impersonation. In newsrooms the work looks like verification: tracing where a video first appeared and whether anyone altered it before an editor runs it. Corporate security and threat-intelligence groups apply the same skills to executive impersonation and fake video calls.

The toolkit

The daily method stacks three layers. First, automated detectors: classifier models that score an image, video or audio file for signs of generation or manipulation. Second, classic forensics: metadata and container review with tools such as ExifTool and FFmpeg, compression and noise analysis, frame-by-frame inspection of lighting, reflections, lip-sync and edges, and spectrogram review for cloned voices. Third, provenance: checking whether the file carries C2PA Content Credentials, a signed record of how the asset was created and edited.

Provenance takes its own care. The C2PA's July 2026 deployment guidance put its Content Credentials standard at version 2.4, and it warns that not all implementations have gone through the C2PA conformance program, though they may still self-assert that they meet the specification. A careful analyst checks the signing product against the conforming products list and related trust lists before treating a credential as meaningful.

Open-source technique fills the gaps: reverse-image and keyframe searches, archived copies, uploader histories and geolocation of visible landmarks.

The deliverable

The output is a written examination, not a verdict copied off a dashboard. A solid report names the question asked, the original file and its hash, each method applied, what was observed, the limits of those methods and a conclusion with a stated confidence level. Lab examiners can work from SWGDE's Best Practices for Image Authentication, version 2.0 dated March 3, 2025, which covers the evidentiary value, methodology, range of results and limitations of authentication work. It notes that video is composed of still images, so image authentication also applies to video.

Who the analyst works with

Fraud investigators and anti-money-laundering teams, trust-and-safety policy leads, legal and privacy counsel, editors and standards desks, incident responders, and the machine learning engineers who build and retrain detectors. On product-facing teams, the analyst also curates labeled examples of real and fake media that feed model training and evaluation, so detection quality and the analyst's casework improve together.

The title is new and borrows from several older disciplines, so there is no single entry route. As a rough guide, people start with a bachelor's degree in digital forensics, cybersecurity, computer science, data science or an adjacent discipline. O*NET files its closest profile, Digital Forensics Analysts, under Job Zone Four, and by its description most jobs in that zone call for a four-year bachelor's degree, with some exceptions. A portfolio of documented, redacted case reports helps show the work directly.

Where people come from

Analysts arrive from several neighboring fields. Digital forensic examiners from law enforcement labs or e-discovery firms bring evidence handling and courtroom discipline. Fraud and identity analysts bring knowledge of onboarding flows, document fraud and suspicious activity reporting. Trust-and-safety investigators bring policy judgment and comfort with disturbing material. Open-source verification journalists bring sourcing instincts and speed. Machine learning engineers who move toward evaluation work bring an understanding of how generators and detectors fail. As a rough guide, 2 to 5 years in one of these lanes prepares someone for an analyst seat.

Technical skills

• Image science: compression, color spaces, sensor noise, resampling and what each leaves behind.
• Audio: spectrograms, codecs, room tone and the artifacts of voice cloning.
• Video: container structure, frame rates, re-encoding and keyframe extraction.
• Scripting in Python to batch-process files, pull metadata and run detectors at scale.
• Working knowledge of how diffusion models, face-swap tools and voice-cloning systems produce output.
• Statistics: reading precision, recall and false positive rates instead of trusting a single score.

SWGDE's image authentication guidance sets the professional bar plainly: practitioners performing image authentication should have sufficient training and experience in image science to allow the formation of an opinion. NIST's Open Media Forensics Challenge, an evaluation platform open to public researchers, offers one way to practice on test media and show results.

Credentials

No credential is specific to this title, so candidates pick the one that matches their setting. The GIAC Certified Forensic Analyst (GCFA), awarded by GIAC, suits analysts coming from incident response and digital forensics. The Certified Forensic Video Analyst (CFVA) from LEVA suits examiners who handle video evidence for investigations or court. The Certified Fraud Examiner (CFE) from the Association of Certified Fraud Examiners fits analysts on bank and fintech fraud teams.

Soft skills

Clear writing under uncertainty is the core skill: saying what the evidence supports and stopping there. Analysts also need composure with graphic or abusive content, and the discipline to hold a finding when a manager or editor wants a faster, firmer answer.

BLS does not track Deepfake Detection Analysts as an occupation, so there is no official headcount or projection for the title itself. The nearest proxy is ONET's Digital Forensics Analysts profile, which sits inside the BLS residual group Computer Occupations, All Other. For that group, ONET projects faster than average growth (5% to 6%) for 2025-2035 and about 27,000 job openings a year on average. Those figures cover every job in the residual group, not deepfake work specifically.

Federal agencies offer another signal: since late 2024 they have written synthetic media into fraud reporting, platform obligations and testing programs.

Financial crime

FinCEN's alert FIN-2024-Alert004, issued November 13, 2024, said that beginning in 2023 and continuing in 2024, it observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media in fraud schemes. The alert asks filers to include the key term "FIN-2024-DEEPFAKEFRAUD" in suspicious activity reports.

Platform obligations

Section 3 of the TAKE IT DOWN Act, enforced by the Federal Trade Commission, took effect May 19, 2026. Covered platforms that receive a valid request must remove non-consensual intimate images and known identical copies within 48 hours. On May 20, 2026, the FTC sent warning letters to 12 companies that offer so-called "nudify" tools, which generate sexualized images from clothed photos. That 48-hour clock applies to every valid request a review queue receives.

Standards and testing

NIST researchers are developing Guardians of Forensic Evidence, a deepfake evaluation program meant to advance forensic technologies that automatically detect deepfakes. NIST's program page, updated October 30, 2026, says America's AI Action Plan specifically cites the project and recommends that NIST consider developing it into a formal guideline and voluntary forensic benchmark. The same page names the need for improved generalization and robustness against post-processing and anti-forensics filters. Those are the same failure modes analysts probe when they benchmark a detector.

Impersonation pressure

On July 20, 2026, the FBI's Internet Crime Complaint Center warned that scammers were creating AI-generated videos, commonly referred to as deepfakes, on social media platforms to impersonate FBI personnel. Corporate security teams can face the same pattern when the impersonated figure is one of their own executives.

Advancement

From an analyst seat, paths lead to senior examiner or lead investigator roles, detection research and evaluation, management of a trust-and-safety or fraud intelligence unit, and expert witness work for those with lab-grade documentation habits. Because the title is unstandardized, a job search for this work means searching several names: digital forensics analyst, media forensics examiner, synthetic media analyst and identity fraud investigator among them. Analysts who can explain a finding to a judge, an editor and a product team carry that skill into whichever of those titles they hold next.

Dear Hiring Manager,

I am applying for the Deepfake Detection Analyst position on your fraud intelligence team. For the past four years I have worked as a digital forensics examiner at a regional e-discovery firm, where my job was to tell clients and attorneys, in writing, what a file could and could not prove. Over the last two years more of those files were images, voice memos and video clips, and more of the questions were about whether the media was real at all.

That shift taught me to work in layers. I start by preserving the original and hashing it, then pull metadata and container details, inspect frames and spectrograms by hand, and run detection tools only after I know what I expect to see. When a file carries Content Credentials, I validate the signature and check who signed it before I give it any weight. When the evidence is mixed, my report says so and explains why.

One case shaped how I work. A client received a video call recording in which a supplier's executive appeared to approve a change of bank details. The detection tool scored it as likely authentic. My frame review found mismatched reflections in the speaker's glasses and audio that drifted out of sync whenever he turned his head. I documented each observation with timestamps, flagged the tool's miss to our vendor, and the payment was stopped before it went out.

I want to do this work at the scale your team handles, and I am drawn to the chance to help tune your detectors with real casework rather than only consuming their scores. I write clearly for non-technical readers, stay calm with disturbing material, and hold a finding when someone wants a faster answer.

Thank you for your time. I would welcome the chance to walk you through a redacted case report.

Sincerely, Jordan Ellery