Senior DFIR Analyst

Our client is a fast-growing cyber security consultancy across Australia and New Zealand. They are building the Australian arm of their Digital Forensics and Incident Response practice.

They have an immediate need for a Senior DFIR Analyst in a permanent role, with a choice of city across Australia.

You will work on live investigations alongside an established DFIR team across the Tasman, and lead smaller engagements end to end.

The role

• Lead smaller incident response engagements from scoping to final report


• Respond to ransomware, business email compromise, malware and insider threat cases


• Collect and preserve evidence; run host, memory and log analysis


• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint


• Write clear findings and reports for technical and non-technical readers

This is hands-on investigation, not alert monitoring.

What you'll need to succeed;

• About 3 to 5 years hands-on in DFIR


• Hands-on with EDR and forensic tooling


• Clear written reports for technical and non-technical readers


• Eligible for an Australian Baseline security clearance and able to pass a police check


• GCFA, GCFE, GCIH, CCFR or SC-200 advantageous; proven experience counts more


• Python or PowerShell scripting, and Microsoft 365 or cloud investigations, are a plus