DFIR Analyst

Our client is a fast-growing cyber security consultancy across Australia and New Zealand. They are building the Australian arm of their Digital Forensics and Incident Response practice.

They have an immediate need for a DFIR Analyst in a permanent role based in Sydney.

You will work on live investigations alongside an established DFIR team across the Tasman, and grow quickly into more senior work.

The role

• Respond to ransomware, business email compromise, malware and insider threat cases
• Collect and preserve evidence under guidance
• Run host, memory and log analysis
• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint
• Write clear findings and reports

This is hands-on investigation, not alert monitoring.

What you'll need to succeed;

• 1 to 3 years in DFIR, or a strong SOC or IR analyst ready to step up
• Hands-on with EDR and forensic tooling
• Clear written reports for technical and non-technical readers
• Eligible for an Australian Baseline security clearance and able to pass a police check
• GCFA, GCFE, GCIH, CCFR or SC-200 advantageous; proven experience counts more
• Python or PowerShell scripting, and Microsoft 365 or cloud investigations, are a plus

Suitably skilled candidates are encouraged to apply with an achievement-based CV.