DFIR Analyst — Live Investigations & Forensics

The Cache Group; Melbourne; On-site; AUD 90,000 - 130,000; Full time

Job summary

The Cache Group is seeking a DFIR Analyst in Melbourne to join a fast-growing cyber security consultancy actively building its Australian practice. This hands-on role focuses on live investigations rather than alert monitoring, with opportunities to rapidly grow into more senior work.

You will work alongside an established DFIR team across the Tasman, handling ransomware, BEC, malware and insider-threat cases while developing clear, practitioner-ready reports for technical and non-technical

Qualifications

• 1 to 3 years in DFIR
• Hands-on with EDR and forensic tooling
• Clear written reports for technical and non-technical readers
• Eligible for Australian Baseline security clearance
• GCFA/GCFE/GCIH/CCFR/SC-200 advantageous
• Python or PowerShell scripting and cloud investigations a plus

Responsibilities

• Respond to ransomware, business email compromise, malware and insider threat cases
• Collect and preserve evidence under guidance
• Run host, memory and log analysis
• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint
• Write clear findings and reports

Skills

DFIR

Scripting (Python/PowerShell)

Clear written reports

Security clearance eligibility

Cloud investigations

Tools

EDR tooling

Forensic tooling

Velociraptor

CrowdStrike

Defender for Endpoint

Job description

The Cache Group is seeking a DFIR Analyst in Melbourne to join a fast-growing cyber security consultancy actively building its Australian practice. This hands-on role focuses on live investigations rather than alert monitoring, with opportunities to rapidly grow into more senior work.

You will work alongside an established DFIR team across the Tasman, handling ransomware, BEC, malware and insider-threat cases while developing clear, practitioner-ready reports for technical and non-technical