DFIR Analyst

TTC Group (Tech Talent Consulting); Australia; Remote; AUD 90,000 - 150,000; Full time

Job summary

TTC Group (Tech Talent Consulting) is seeking a DFIR Analyst for a remote role based in Australia. You will work closely with the Director of Global Incident Response Operations in a metrics-driven environment, delivering incident response outcomes and supporting a global team.

Responsibilities include live endpoint investigations, developing IR methods, and coordinating with third parties to address security breaches.

Qualifications

• Minimum 2–3 years of DFIR experience.
• Experience deploying and managing EDR technology.
• Familiar with the NIST Cybersecurity Framework.

Responsibilities

• Support a wide range of technologies and perform advanced troubleshooting (packet captures, debugs, traffic analysis).
• Contribute to development of IR lifecycles and post-breach remediation policies and procedures.
• Document incident response methods and guidelines for the organization.
• Perform live-endpoint investigations and provide remediation actions.
• Implement and deploy an IR-focused ticketing system to improve incident tracking and metrics.
• Collaborate with 3rd parties for incident response and remediation.
• Prepare high-level technical reports for clients.
• Be part of a 24x7/365 service delivery team handling incidents and root-cause analysis.

Skills

DFIR experience

Incident response

Troubleshooting

Regional coverage

Tools

EDR deployment

NIST framework

Forensic tools

SIEM

Networking & VPNs

Job description

We have an urgent role for a DFIR Analyst, which is remote. Please go through the JD below:

Role: DFIR Analyst

Duration: Full-time

Location: Remote (Australia)

Mode of Interview: 3-4 rounds of video interviews

Travel Required: 5% Travel

JOB DESCRIPTION

The successful candidate will work closely with the Director of Global Incident Response Operations. The ideal candidate will have an energetic, can-do attitude and be comfortable working in a metrics-driven environment, delivering results and supporting team members.

Essential Functions

• Responsible for supporting a wide number of technologies and being able to proficiently perform advanced troubleshooting on the fly (packet captures, debugs, traffic analysis)
• Work on the continued development of CIRT and Machine investigation lifecycles as part of the ongoing process to enhance IR capabilities; also provided significant contribution to the revision of Incident Response and Post-Breach Remediation policies, procedures, and processes.
• Responsible for developing and documenting Incident Response methods and guidelines for the organizations
• Performed live-endpoint investigation, including the identification and gathering of key forensic artifacts, offline investigation as needed, and providing remediation actions as needed.
• Implemented and deployed an Incident Response-focused ticketing system to improve incident tracking, remediation, and metrics for incidents worked.
• Responsible for working with 3rd parties to assist with incident response, business email compromise, security breaches, improve overall security, investigations, recommendations, and remediation.
• Developing and providing high-level technical reports in response to clients
• Serve as a member of a 24x7/365 service delivery team that handles incident response, post-breach remediation, escalation, required to perform complex investigations and/or troubleshooting and driving root cause to resolution.

Required Skills and Experience

• Minimum 2-3 years of experience in DFIR
• Experience in the deployment and management of EDR Technology
• Experience with Security Technologies and the NIST Framework
• Developing, documenting, and implementing incident response methods and processes
• Perform live endpoint investigations
• Experience in forensic investigations both on-premises and cloud
• Must be available to provide coverage to meet business requirements in 3 regions
• Strong knowledge of DFIR Tools
• Strong knowledge of Virtualization Technologies, Operating Systems, Firewalls, VPN’s, SIEM
• Enterprise Gateway Technologies, Networking Devices, Security Technologies, etc.