Principal DFIR Consultant

Cache Group; Sydney; On-site; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Job summary

Cache Group is seeking a Principal DFIR Consultant for its Sydney CBD operation. You will lead end‑to‑end incident response engagements, run host, memory and log forensics, and develop relationships with insurers and partners. This is a senior, hands‑on role with a pathway to running the Australian practice.

You will work with the Tasman DFIR team and be the first permanent DFIR hire in Australia, reporting to the onshore leadership and contributing to service development and methodology.

Qualifications

• 8+ years in cyber security with a substantial DFIR component.
• Senior, hands‑on incident response experience, ideally in a consultancy or MSSP.
• Ability to work independently as the senior DFIR practitioner onshore.
• Clear report writing, able to explain findings to non‑technical audiences.
• Eligible for an Australian security clearance; Baseline is sponsored.
• CrowdStrike and Microsoft Defender for Endpoint experience is highly regarded.
• GCFA, GCFE, GCIH or similar is advantageous; proven experience counts.
• Expert witness experience is desirable.

Responsibilities

• Lead incident response engagements end to end, from scoping to final report.
• Hunt at scale with Velociraptor and run host, memory and log forensics.
• Build relationships with cyber insurers, IR law firms and partners.
• Present findings to technical teams, legal counsel and executives.
• Help shape the trans‑Tasman service, methodology and team.
• This is a senior practitioner role with a commercial edge, not business development.
• It offers a path to running the Australian practice.

Job description

Our client is a fast-growing cyber security consultancy across Australia and New Zealand. They are building the Australian arm of their Digital Forensics and Incident Response practice.

They have an immediate need for a Principal DFIR Consultant in Sydney CBD, in a newly created permanent role.

You will be the first permanent DFIR consultant on the ground in Australia, leading investigations and building the relationships that bring the work in. You will work day to day with an established DFIR team across the Tasman, with two more hands‑on hires to follow.

The role

Lead incident response engagements end to end, from scoping to final report

Hunt at scale with Velociraptor and run host, memory and log forensics

Build on relationships with cyber insurers, IR law firms and partners

Present findings to technical teams, legal counsel and executives

Help shape the trans‑Tasman service, methodology and team

This is a senior practitioner role with a commercial edge, not business development. It offers a path to running the Australian practice.

What you'll need to succeed;

8+ years in cyber security, with a substantial DFIR component

Senior, hands‑on incident response experience, ideally in a consultancy or MSSP

Confidence working independently as the senior DFIR practitioner onshore

Clear report writing, and able to explain findings to non-technical audiences

Eligible for an Australian security clearance; Baseline is sponsored

CrowdStrike and Microsoft Defender for Endpoint experience is highly regarded

GCFA, GCFE, GCIH or similar is advantageous; proven experience counts more

Expert witness experience is desirable