Hybrid Digital Forensics Analyst – DFIR & Incident Response

Triskele Labs; City of Melbourne; Hybrid; AUD 80,000 - 120,000; Full time

Benefits offered by this job

Hybrid working environment

Salary packaging/novated leasing

Discounts & Benefits Platform access

Ongoing training opportunities

Work‑life balance support

Job summary

Triskele Labs is a cyber security firm providing DFIR services across Australia, with on‑site and remote work. The Digital Forensics Team investigates incidents, establishes intrusion methods, and documents data access or loss with formal reports for clients and insurers.

The role requires 1+ year in digital forensics, knowledge of Windows/Linux artefacts, and exposure to M365 investigations. A hybrid work pattern and ongoing training are available.

Qualifications

• Minimum one year of experience in a digital forensics role.
• Understanding of the incident lifecycle.
• Sound understanding of Windows and Linux forensic artefacts.
• Exposure to Microsoft 365 investigation is advantageous.
• Experience acquiring and handling evidence in a forensically sound manner, including chain of custody.
• Familiarity with Threat Actor tactics, techniques and procedures.
• Business-fluent written English.
• Eligibility to work in Australia.

Responsibilities

• Investigate cyber incidents for clients across Australia, remotely and on site, and establish how an intrusion occurred.
• Determine what the Threat Actor did and whether data was accessed or taken.
• Prepare written reports that stand up to review by clients, insurers and legal counsel.
• Work on reactive matters and proactive retainer work for forensic readiness and response planning.
• Collaborate with a highly technical DFIR team and handle matters with others in the group.
• Contribute to ongoing investigations of ransomware, data extortion and insider threats.

Skills

Digital forensics

Incident response

Windows forensics

Linux forensics

Microsoft 365 investigation

Evidence handling & chain of custody

Threat actor TTPs

English communication

Eligibility to work in Australia

Tools

Magnet Axiom

X-Ways Forensics

Intella

KAPE

EZ Tools

Hayabusa

Velociraptor

Chainsaw

Volatility

SentinelOne

CrowdStrike

Microsoft Defender

Carbon Black

Microsoft Sentinel

Elastic

Rapid7

Job description

Triskele Labs is a cyber security firm providing DFIR services across Australia, with on‑site and remote work. The Digital Forensics Team investigates incidents, establishes intrusion methods, and documents data access or loss with formal reports for clients and insurers.

The role requires 1+ year in digital forensics, knowledge of Windows/Linux artefacts, and exposure to M365 investigations. A hybrid work pattern and ongoing training are available.