DFIR Analyst

TTC Group (Tech Talent Consulting); Australia; On-site; AUD 90,000 - 130,000; Full time

Job summary

Forensic Focus is seeking a DFIR expert to join our global incident response team in Australia. You will perform live-endpoint and offline forensic investigations, identify key artifacts, and guide remediation across on-prem and cloud environments.

You will contribute to developing IR methodologies, documentation, and our ticketing system while collaborating with third parties on breaches and business email compromise cases. This fast-paced, metrics-driven role suits a proactive practitioner.

Qualifications

• 2–3 years of DFIR experience.
• Experience with EDR deployment and management.
• Familiar with the NIST Cybersecurity Framework.
• Experience with SIEM, firewalls, VPNs, virtualization, and networking technologies.
• Forensic investigations in on-premises and cloud environments.
• Certifications such as GCIH/GCFE are preferred.

Responsibilities

• Perform live-endpoint and offline forensic investigations.
• Identify key artifacts to guide remediation.
• Contribute to developing IR methodologies and documentation.
• Maintain a ticketing system and track findings.
• Collaborate with third parties on breaches and business email compromise cases.

Skills

DFIR experience

EDR deployment

NIST framework familiarity

SIEM

firewalls

VPNs

virtualization

networking technologies

Education

GCIH certification

GCFE certification

Tools

EDR

SIEM

firewalls

VPNs

virtualization

networking

Job description

The Role

This position supports global incident response operations, performing live-endpoint and offline forensic investigations, identifying key artifacts, and guiding remediation. The analyst contributes to developing IR methodologies, documentation, and a ticketing system, while collaborating with third parties on breaches and business email compromise cases.

Skills & Experience

Requires 2-3 years of DFIR experience, EDR deployment and management, familiarity with the NIST framework, SIEM, firewalls, VPNs, virtualization, and networking technologies. Forensic investigation experience spans on-premises and cloud environments. GCIH and GCFE certifications are preferred.

Who It Suits

Suited to a proactive DFIR practitioner comfortable in a metrics-driven, fast-paced environment, able to work across multiple time zones, support clients directly, and contribute to evolving incident response processes within a global team.