Digital Forensics Analyst

Triskele Labs; Melbourne; Hybride; AUD 95 000 - 130 000; Plein temps

Avantages offerts par ce poste

Annual training budget

Hybrid working

Onshore team

Résumé du poste

Triskele Labs in Melbourne is seeking a dedicated digital forensics and incident response professional to join our onshore DFIR team. From day one you will handle live incidents including ransomware, BEC, and unauthorized access, acquiring and preserving evidence, building the timeline, and generating reports relied upon by executives and insurers.

You will collaborate with incident responders, panel law firms and insurers, shaping forensic playbooks, mentoring junior analysts, and ensuring

Qualifications

• 3+ years hands-on digital forensics or IR with end-to-end case work.
• Experience with industry forensic tools listed.
• Experience in Windows AD and at least one major cloud platform.
• Written forensic reports relied on by clients or insurers.
• Australian citizenship required for government work.

Responsabilités

• Own evidence acquisition and preservation across endpoints, servers, cloud tenants and mobile devices, maintaining chain of custody.
• Conduct disk, memory, log and cloud forensic analysis to reconstruct attacker activity and data exfiltration.
• Perform data impact assessments to support notification decisions under the Privacy Act and SOCI Act.
• Write clear, defensible forensic reports and present findings to executives, legal counsel, insurers and law enforcement.
• Support containment and recovery alongside incident responders and SOC analysts.
• Contribute to retainer and readiness work including tabletop exercises and readiness reviews.
• Improve forensic tooling, automation and case documentation standards.

Connaissances

Digital forensics

Incident response

Forensic reporting

Windows forensics

Cloud investigations

Outils

EnCase

FTK

X-Ways

Magnet AXIOM

Velociraptor

KAPE

Plaso

Volatility

Description du poste

Every engagement our DFIR team takes on starts with the same question from a client: what happened, how far did it go, and can you prove it. This role exists to answer that question with evidence that stands up to a board, an insurer, a regulator or a court.

About Triskele Labs

Triskele Labs is an Australian sovereign, independent, founder-owned cybersecurity business on a journey to be a leading provider of cybersecurity services done properly, built on purpose, culture and mission. We work across Government, Corporate and Enterprise, APRA regulated and highly regulated sectors, while continuing to support the mid-market. Our DFIR practice is fully onshore, delivering incident response, retainer and readiness services alongside a 24x7 Managed Detection and Response capability.

About the role

From day one you will be on live incidents including Ransomware, BEC, Unauthorised Access and more. You will acquire and preserve evidence, build the timeline, establish root cause and scope, and produce reports that non-technical executives and their lawyers rely on to make decisions. You will work directly with our incident responders, panel law firms and insurers, with the backing of a fully onshore team and the tooling to do the job properly. As you settle in, you will shape our forensic playbooks, mentor junior analysts and become the person panel partners trust to get the facts right.

What you will do

• Own evidence acquisition and preservation across endpoints, servers, cloud tenants (Microsoft 365, Azure, AWS) and mobile devices, maintaining chain of custody throughout
• Conduct disk, memory, log and cloud forensic analysis to reconstruct attacker activity, establish initial access, lateral movement, persistence and data exfiltration
• Perform data impact assessments to support notification decisions under the Privacy Act and the SOCI Act
• Write clear, defensible forensic reports and present findings to executives, legal counsel, insurers and, where required, law enforcement
• Support containment and recovery alongside our incident responders and SOC analysts
• Contribute to retainer and readiness work including tabletop exercises, compromise assessments and forensic readiness reviews
• Improve our forensic tooling, automation and case documentation standards

What we are looking for

Required

• 3 or more years of hands-on digital forensics or incident response experience, with cases you have personally worked from acquisition through to reporting
• Demonstrated experience with industry forensic tooling such as EnCase, FTK, X-Ways, Magnet AXIOM, Velociraptor, KAPE, Plaso or Volatility
• Experience investigating Windows environments, including Active Directory attack paths, and at least one major cloud platform
• Written forensic reports that have been relied upon by clients, legal teams or insurers
• Australian citizenship (required for the Government work this role supports)

Preferred

• GCFA, GCFE, GNFA, GREM, CHFI or equivalent certification
• Experience giving evidence or producing reports for litigation or regulatory proceedings
• Malware triage or reverse engineering skills
• Experience with ransomware negotiation support, business email compromise or insider threat investigations
• Scripting in Python or PowerShell for artefact parsing and automation

What it is like

Incident response is unpredictable. There will be weeks that are calm and weeks where you are on a bridge call at 2am with a client whose business is down. We run a rostered on-call model, we rotate people off active cases to recover, and we invest in training and certifications every year. If you want to do serious forensic work on real Australian incidents, with a team that is entirely onshore and takes the craft seriously, this is the place.

• A sovereign Australian team working on the incidents that matter to Australian organisations
• Direct exposure to executives, boards, legal counsel and insurers from day one
• Annual training and certification budget
• Clear progression into senior analyst and lead investigator roles
• Melbourne CBD office with hybrid working

Triskele Labs is an equal opportunity employer and welcomes applications from people of all backgrounds.