Senior DFIR Analyst

Launch Group; Melbourne; Remote; AUD 110,000 - 150,000; Full time

Job summary

Launch Recruitment, partnering with a global cyber security organisation, seeks a DFIR Analyst to investigate incidents across endpoints, networks and cloud, and to lead client communications.

You will perform triage, containment, and remediation, with emphasis on Business Email Compromise, and you’ll present findings to technical and non-technical audiences.

This remote, permanent role offers exposure to a global IR team and opportunities to strengthen cyber resilience for diverse clients.

Qualifications

• 2–3 years hands-on DFIR experience in investigations
• Experience with BEC incidents and incident triage
• Ability to investigate across on-prem and cloud environments

Responsibilities

• Lead and support DFIR investigations across endpoint, network, cloud and enterprise environments
• Perform incident triage, containment, eradication and remediation activities
• Investigate BEC incidents including compromised accounts and phishing
• Develop incident reports and remediation recommendations
• Present findings to clients and participate in tabletop exercises

Skills

DFIR

BEC investigations

Incident triage

Client engagement

Tabletop exercises

EDR

SIEM

Forensic investigations

Cloud & on-prem

Tools

EDR tools

SIEM platforms

Forensic investigation tools

Job description

Digital Forensics & Incident Response (DFIR) Analyst

Location: Remote

Employment Type: Permanent, Full-Time

The Opportunity

Launch Recruitment is partnering with a global cyber security organisation specialising in Digital Forensics and Incident Response (DFIR) to recruit an experienced DFIR Analyst.

This is a highly technical, client-facing opportunity for someone who thrives on investigating cyber security incidents, identifying the root cause of security breaches and helping organisations respond to and recover from cyber attacks.

We are particularly interested in candidates with strong hands-on experience investigating Business Email Compromise (BEC) incidents, conducting incident triage and managing complex digital forensic investigations.

Beyond the technical responsibilities, this role requires someone who is confident engaging directly with clients, explaining complex security incidents to both technical and non-technical audiences, and facilitating incident response tabletop exercises.

You’ll work as part of a global incident response team, supporting clients across a range of industries and helping strengthen their cyber security resilience.

Key Responsibilities

Digital Forensics & Incident Response

• Lead and support digital forensic investigations across endpoint, network, cloud and enterprise environments.
• Conduct incident triage, investigation, containment, eradication and remediation activities.
• Investigate Business Email Compromise (BEC) incidents, including compromised accounts, phishing attacks, email fraud and unauthorised mailbox access.
• Analyse forensic evidence, security logs and endpoint activity to determine the root cause, scope and impact of security incidents.
• Perform live endpoint investigations, collect forensic artefacts and conduct offline forensic analysis where required.
• Utilise EDR, SIEM and other security technologies to investigate suspicious activity and support incident response.
• Develop detailed incident reports, investigation findings and remediation recommendations.
• Contribute to the ongoing improvement of incident response procedures, investigation methodologies and post-breach remediation processes.

Client Engagement & Incident Response Readiness

• Act as a key technical contact for clients throughout security investigations, providing clear updates, findings and recommendations.
• Facilitate and participate in client-facing incident response tabletop exercises, helping organisations assess their readiness and identify gaps in their response capabilities.
• Confidently present technical findings and investigation outcomes to clients, including senior stakeholders and non-technical audiences.
• Work closely with clients to understand their environments, assess security incidents and recommend practical remediation strategies.
• Support clients in developing and improving incident response plans, procedures and overall cyber resilience.
• Collaborate with internal technical teams and external stakeholders to coordinate effective incident response activities.

Essential Skills & Experience

• Demonstrated hands-on experience in Digital Forensics and Incident Response (DFIR), ideally with a minimum of 2–3 years in a dedicated incident response or forensic investigation role.
• Strong experience investigating Business Email Compromise (BEC) incidents, including email account compromise, phishing-related breaches and associated incident triage.
• Proven ability to investigate security incidents from initial identification through to containment, forensic analysis and remediation.
• Experience conducting forensic investigations across on-premise and cloud environments.
• Hands-on experience with EDR technologies, SIEM platforms and digital forensic investigation tools.
• Strong understanding of operating systems, networking, security technologies and incident response methodologies.
• Confidence facilitating or presenting incident response tabletop exercises and discussing cyber security scenarios with clients.
• Excellent communication and stakeholder engagement skills, with the ability to explain complex technical findings clearly.
• Strong analytical, problem-solving and investigation skills.
• Ability to work independently, manage multiple investigations and remain composed during critical security incidents.

Highly Desirable

• Previous experience working in a cyber security consultancy, managed security service provider (MSSP) or client-facing incident response environment.
• Experience investigating Microsoft 365, Exchange Online and cloud-based identity compromises.
• Familiarity with Microsoft Defender, Entra ID, Sentinel or similar investigation platforms.
• Experience developing incident response playbooks, investigation procedures or client-facing security documentation.
• Relevant industry certifications such as GCIH, GCFE or GCFA.
• Experience contributing to incident response readiness assessments or cyber security workshops.