DFIR Analyst

Cache Group; Sydney; On-site; AUD 90,000 - 150,000; Full time

Job summary

Cache Group is building the Australian arm of a Digital Forensics and Incident Response practice in Sydney. You will work on live investigations with an established DFIR team across the Tasman and grow quickly into more senior work.

The role focuses on responding to ransomware, BEC, malware and insider threats, collecting and preserving evidence, and performing host/memory/log analysis withVelociraptor and EDR tools. It is hands-on, not alert monitoring.

Qualifications

• 1–3 years in DFIR, or a strong SOC/IR background ready to step up.
• Hands-on with EDR and forensic tooling.
• Able to write clear reports for technical and non-technical readers.
• Eligible for Australian Baseline security clearance and police check.

Responsibilities

• Respond to ransomware, BEC, malware and insider threat cases.
• Collect and preserve evidence under guidance.
• Run host, memory and log analysis.
• Hunt with Velociraptor and contain with EDR like CrowdStrike or Defender for Endpoint.
• Write clear findings and reports.
• This is hands-on investigation, not alert monitoring.

Skills

DFIR

SOC experience

Incident response

Clear reporting

Python scripting

PowerShell scripting

Microsoft 365 investigations

Tools

CrowdStrike

Defender for Endpoint

Velociraptor

Forensic tooling

Job description

Our client is a fast-growing cyber security consultancy across Australia and New Zealand. They are building the Australian arm of their Digital Forensics and Incident Response practice.

They have an immediate need for a DFIR Analyst in a permanent role based in Sydney.

You will work on live investigations alongside an established DFIR team across the Tasman, and grow quickly into more senior work.

The role

Respond to ransomware, business email compromise, malware and insider threat cases

Collect and preserve evidence under guidance

Run host, memory and log analysis

Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint

Write clear findings and reports

This is hands-on investigation, not alert monitoring.

What you'll need to succeed;

1 to 3 years in DFIR, or a strong SOC or IR analyst ready to step up

Hands-on with EDR and forensic tooling

Clear written reports for technical and non-technical readers

Eligible for an Australian Baseline security clearance and able to pass a police check

GCFA, GCFE, GCIH, CCFR or SC-200 advantageous; proven experience counts more

Python or PowerShell scripting, and Microsoft 365 or cloud investigations, are a plus

Suitably skilled candidates are encouraged to apply with an achievement-based CV.