DFIR Analyst

The Cache Group; Melbourne; Presencial; AUD 90.000 - 130.000; Jornada completa

Descripción de la vacante

The Cache Group is seeking a DFIR Analyst in Melbourne to join a fast-growing cyber security consultancy actively building its Australian practice. This hands-on role focuses on live investigations rather than alert monitoring, with opportunities to rapidly grow into more senior work.

You will work alongside an established DFIR team across the Tasman, handling ransomware, BEC, malware and insider-threat cases while developing clear, practitioner-ready reports for technical and non-technical

Formación

• 1 to 3 years in DFIR
• Hands-on with EDR and forensic tooling
• Clear written reports for technical and non-technical readers
• Eligible for Australian Baseline security clearance
• GCFA/GCFE/GCIH/CCFR/SC-200 advantageous
• Python or PowerShell scripting and cloud investigations a plus

Responsabilidades

• Respond to ransomware, business email compromise, malware and insider threat cases
• Collect and preserve evidence under guidance
• Run host, memory and log analysis
• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint
• Write clear findings and reports

Conocimientos

DFIR

Scripting (Python/PowerShell)

Clear written reports

Security clearance eligibility

Cloud investigations

Herramientas

EDR tooling

Forensic tooling

Velociraptor

CrowdStrike

Defender for Endpoint

Descripción del empleo

Our client is a fast-growing cyber security consultancy across Australia and New Zealand. They are building the Australian arm of their Digital Forensics and Incident Response practice.

They have an immediate need for a DFIR Analyst in a permanent role based in Melbourne.

You will work on live investigations alongside an established DFIR team across the Tasman, and grow quickly into more senior work.

The role

• Respond to ransomware, business email compromise, malware and insider threat cases
• Collect and preserve evidence under guidance
• Run host, memory and log analysis
• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint
• Write clear findings and reports

This is hands-on investigation, not alert monitoring.

What you'll need to succeed;

• 1 to 3 years in DFIR, or a strong SOC or IR analyst ready to step up
• Hands-on with EDR and forensic tooling
• Clear written reports for technical and non-technical readers
• Eligible for an Australian Baseline security clearance and able to pass a police check
• GCFA, GCFE, GCIH, CCFR or SC-200 advantageous; proven experience counts more
• Python or PowerShell scripting, and Microsoft 365 or cloud investigations, are a plus