DFIR Investigator: Live Forensics & Malware Response

Cache Group; Sydney; On-site; AUD 90,000 - 150,000; Full time

Job summary

Cache Group is building the Australian arm of a Digital Forensics and Incident Response practice in Sydney. You will work on live investigations with an established DFIR team across the Tasman and grow quickly into more senior work.

The role focuses on responding to ransomware, BEC, malware and insider threats, collecting and preserving evidence, and performing host/memory/log analysis withVelociraptor and EDR tools. It is hands-on, not alert monitoring.

Qualifications

• 1–3 years in DFIR, or a strong SOC/IR background ready to step up.
• Hands-on with EDR and forensic tooling.
• Able to write clear reports for technical and non-technical readers.
• Eligible for Australian Baseline security clearance and police check.

Responsibilities

• Respond to ransomware, BEC, malware and insider threat cases.
• Collect and preserve evidence under guidance.
• Run host, memory and log analysis.
• Hunt with Velociraptor and contain with EDR like CrowdStrike or Defender for Endpoint.
• Write clear findings and reports.
• This is hands-on investigation, not alert monitoring.

Skills

DFIR

SOC experience

Incident response

Clear reporting

Python scripting

PowerShell scripting

Microsoft 365 investigations

Tools

CrowdStrike

Defender for Endpoint

Velociraptor

Forensic tooling

Job description

Cache Group is building the Australian arm of a Digital Forensics and Incident Response practice in Sydney. You will work on live investigations with an established DFIR team across the Tasman and grow quickly into more senior work.

The role focuses on responding to ransomware, BEC, malware and insider threats, collecting and preserving evidence, and performing host/memory/log analysis withVelociraptor and EDR tools. It is hands-on, not alert monitoring.