Principal Analyst

Infotrust; Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Flexible, hybrid working

Job summary

Infotrust is seeking a Principal Analyst to join our Digital Forensics & Incident Response (DFIR) team in Sydney. You will lead complex investigations, articulate your reasoning, and guide best practices across engagements with legal and client stakeholders.

You will bring 8+ years of hands-on DFIR experience across Windows, macOS, Linux/Unix, cloud services, and mobile forensics, with strong scripting and communication skills. Hybrid work arrangements are supported.

Qualifications

• 8+ years hands-on DFIR experience across Windows/macOS/Linux, cloud and mobile.
• Forensic acquisition/analysis of file systems, memory and artefacts.
• SIEM/EDR data interpretation and cloud-native investigations.
• Scripting for automation and evidence processing.
• Confident communicator, able to justify expert opinion in court.
• Detail-oriented, calm under pressure, collaborative with clients.

Responsibilities

• Lead complex investigations and high-impact cyber incidents.
• Provide definitive written and oral advice on forensic matters.
• Direct leading-edge research and develop DFIR techniques and tools.
• Establish technical standards, service models and training.
• Manage multidisciplinary projects with internal and external stakeholders.
• Contribute to business development and market engagement.

Skills

DFIR expertise

Windows

macOS

Linux/Unix

Cloud forensics

Mobile forensics

SIEM/EDR analysis

CrowdStrike

Python scripting

PowerShell/Bash

Court testimony

Tools

ELK

Splunk

CrowdStrike

Job description

Sydney, NSW

Full time / Permanent

About Us

Infotrust is one of Australia’s leading cyber security and technology services companies. We help organisations secure their future - protecting people, data and systems through specialist expertise across managed technology, cyber, cloud, consulting and data protection. We’re growing fast, and our people are at the heart of everything we do.

The Role

Forensic IT is seeking an experienced and highly motivated Principal Analyst to join our Digital Forensics & Incident Response (DFIR) team.

As a Principal Analyst, you’ll bring deep expertise across core DFIR fundamentals — with the ability to clearly articulate not only what decisions you made and how you reached them, but crucially why those decisions are sound and defensible. You’ll lead our most complex investigations and help shape the direction of the practice.

Key Responsibilities

• Lead complex investigations and casework, including high-impact cyber incidents at the forefront of the discipline.
• Provide definitive written and oral advice on complex, sensitive or contentious forensic matters, and set casework acceptance criteria.
• Direct leading-edge research and develop techniques, tools and strategies that advance DFIR practice.
• Establish technical and professional standards, service delivery models and internal training standards for the team.
• Manage and lead complex multidisciplinary projects, engaging internal and external stakeholders.
• Contribute to business development and market engagement across law firms, corporate legal teams, insurers and referral partners.

Skills & Experience

• Minimum 8 years’ hands‑on DFIR experience across Windows, macOS, Linux/Unix, cloud (M365, AWS, Azure) and mobile (iOS/Android).
• Forensic acquisition and analysis of file systems, memory and core artefacts.
• SIEM/EDR data interpretation (e.g. ELK, Splunk, CrowdStrike) and cloud‑native investigations.
• Scripting capability (Python, PowerShell, Bash) for automation and evidence processing.
• Confident communicator, comfortable justifying expert opinion to stakeholders and in court.
• Detail‑oriented, calm under pressure and collaborative, with a strong client-service ethic.

Highly Regarded

• GIAC Certified Forensic Analyst (GCFA) or Certified Forensic Computer Examiner (CFCE).
• Prior expert-witness / courtroom experience.
• Ability to obtain NV1 security clearance.

Why Infotrust

• A high-growth, people-first culture where your work has genuine impact.
• Ongoing investment in your development - certifications, training and clear career pathways.
• Work alongside some of the best specialists in the Australian market.
• Flexible, hybrid working and a supportive, collaborative team environment.