Cyber Investigations Manager

Downer; Sydney; On-site; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Flexible work arrangements

Parental leave

Employee Assistance Program

Diversity and inclusion

Professional development

Job summary

Downer is seeking a hands-on Cyber Investigations Manager based in Sydney to lead complex cyber investigations and coordinate digital forensics across the enterprise. This role combines investigative judgment with clear communication and practical leadership to strengthen our incident response capability.

You will mentor the Investigation & Forensics Analyst, manage relationships with MSSPs and vendors, translate technical findings into actionable recommendations for executives, and ensure

Qualifications

• Experience leading cyber investigations or digital forensics.
• Ability to translate technical findings into business risk and remediation.
• Knowledge of cyber security frameworks (NIST/ISO 27001) and incident response.
• Mentoring or coaching others is advantageous.
• Experience coordinating with vendors, MSSPs or investigation partners.

Responsibilities

• Lead complex cyber investigations and coordinate digital forensic activities across the organisation.
• Manage investigation activities for escalated cyber security incidents, including determining scope, business impact, root cause, and remediation requirements.
• Ensure evidence is collected, handled, documented, and retained in accordance with agreed procedures and governance requirements.
• Translate technical findings, forensic evidence and security artefacts into clear investigation conclusions and actionable recommendations.
• Coordinate across internal teams and external specialists during sensitive or high-profile investigations.
• Drive lessons learned from investigations into improved security controls, detection capabilities, incident response playbooks and remediation programs.
• Provide leadership, coaching and direction to the Investigation & Forensics Analyst while fostering a culture of continuous improvement and knowledge sharing.
• Manage relationships with security vendors, managed security service providers (MSSPs) and specialist investigation partners to support effective investigation outcomes.
• Deliver stakeholder-ready reporting and communicate sensitive findings appropriately to technical, business and executive audiences.
• Contribute to the ongoing maturity of Downer's cyber defence capability through process enhancement, training, exercises and operational improvements.

Skills

Cyber investigations

Digital forensics

Incident response

Stakeholder engagement

Leadership coaching

Security tooling

Education

Cyber security degree

Information technology degree

Tools

SIEM platforms

EDR/XDR tools

Forensic tooling

eDiscovery tooling

Job description

Lead complex cyber investigations and digital forensic activities while helping strengthen our incident response capability across the enterprise.

We have an exciting opportunity for a hands-on Cyber Investigations Manager to join Downer's Cyber Defence function. Based in Sydney, this role leads complex cyber investigations, coordinates digital forensic activities and helps strengthen our incident response capability across the enterprise.
This is a practical leadership role for someone who enjoys investigation work, evidence-led analysis, stakeholder engagement and developing capability in teams. Previous formal people leadership experience is valued, but not essential. We also welcome candidates who have demonstrated mentoring, coaching or technical leadership in cyber security, investigations or digital forensics environments.
Reporting to the Head of Cyber Defence, you will help ensure investigation outcomes are timely, defensible and aligned to business priorities, legal and privacy expectations, and Downer's cyber security strategy.

About the Role

In this role you will:

• Lead complex cyber investigations and coordinate digital forensic activities across the organisation.
• Manage investigation activities for escalated cyber security incidents, including determining scope, business impact, root cause, and remediation requirements.
• Ensure evidence is collected, handled, documented, and retained in accordance with agreed procedures and governance requirements.
• Translate technical findings, forensic evidence and security artefacts into clear investigation conclusions and actionable recommendations.
• Coordinate across internal teams and external specialists during sensitive or high-profile investigations.
• Drive lessons learned from investigations into improved security controls, detection capabilities, incident response playbooks and remediation programs.
• Provide leadership, coaching and direction to the Investigation & Forensics Analyst while fostering a culture of continuous improvement and knowledge sharing.
• Manage relationships with security vendors, managed security service providers (MSSPs) and specialist investigation partners to support effective investigation outcomes.
• Deliver stakeholder-ready reporting and communicate sensitive findings appropriately to technical, business and executive audiences.
• Contribute to the ongoing maturity of Downer's cyber defence capability through process enhancement, training, exercises and operational improvements.

This is a hands-on role where you will combine technical expertise, investigative judgement and clear communication to support sensitive decisions, improve investigation quality and strengthen Downer's cyber resilience over time.

Our Ideal Candidate

You are a proactive cyber investigator or digital forensics professional who enjoys solving complex problems, working through evidence and helping others build confidence and capability. You can move between technical detail and business context, and you are comfortable communicating sensitive findings with care, clarity and discretion.

You bring sound judgement, strong attention to detail and a collaborative style. You are curious, practical and improvement-focused, with the confidence to lead investigations and the humility to keep learning.

What You Will Bring

• Experience conducting, managing or coordinating cyber security investigations, digital forensics or incident response activities in complex environments.
• Hands-on technical investigation skills, including analysis of security events, endpoint and identity activity, network artefacts, logs, alerts, email evidence and cloud or SaaS activity where relevant.
• Practical understanding of digital forensics principles, evidence handling, chain of custody, investigation documentation and defensible reporting.
• Experience using, coordinating or drawing insight from security tooling such as SIEM platforms, EDR or XDR tools, email security platforms, vulnerability management tools, ticketing or case management systems, and forensic or eDiscovery tooling.
• Ability to translate technical findings, forensic artefacts and threat context into clear conclusions, risk-based recommendations and stakeholder-ready reporting.

Experience working closely with a diverse set of stakeholders across Cyber Security, Technology, Legal, HR, Risk, Privacy, business leaders and external partners during sensitive, ambiguous or high-pressure matters.

• Working knowledge of cyber security frameworks, controls and service management practices, such as NIST, ISO/IEC 27001, ASD Essential Eight, ITIL-aligned processes and incident response playbooks.
• Demonstrated experience mentoring, coaching, guiding or developing others. Formal people leadership experience is welcome, but not essential.
• Experience managing security tooling, vendors, managed security service providers or specialist investigation partners is desirable.
• A degree in cyber security, computer science, information technology, management information systems or equivalent practical experience.
• Relevant certifications such as CISSP, CISM, CISA, CRISC, CompTIA Security+, digital forensics, incident response or investigation-related certifications are desirable, but not mandatory.

Benefits Of Working with Downer

• Work with an ASX listed company, working with market leaders.
• Grow your career with us, we are passionate about giving our people opportunities to grow through personal and professional development and continuous learning:
  • Professional development programs
  • Access to professional memberships and industry networks
• Be part of a team that cares, we foster a work environment built on support that is flexible around our employee's wellbeing needs:
  • Flexible work arrangements
  • Parental leave
  • Employee Assistance Program
  • Programs promoting diversity and inclusion
• A range of Corporate Benefits, including:
  • Discounted services (car hires, hotels, insurance, retail stores, gyms)

Why Downer?

As a trusted name in infrastructure, transport, facilities management, and construction, Downer is committed to delivering projects that create a lasting, positive legacy.

We're committed to building a team that reflects the diverse communities we serve, and we welcome people of all ages, genders, sexual orientations, cultures, abilities, and lived experiences.

We especially encourage applications from those whose voices have traditionally been underrepresented in our industry, including women, Aboriginal and Torres Strait Islander Peoples, Māori and Pasifika Peoples, veterans, people with disability, and neurodivergent individuals.

As a WORK180 Endorsed Employer, we support flexibility that works for your life, inclusive leadership that values your voice, and equitable access to opportunity so you can do your best work and bring your whole self to it.