Senior DFIR Analyst

Launch Recruitment - IT Recruiting; Melbourne; Remote; AUD 90,000 - 130,000; Full time

Job summary

Launch Recruitment - IT Recruiting is partnering with a global cyber security organisation to recruit an experienced DFIR Analyst for a remote role supporting clients worldwide.

You will lead digital forensics investigations across endpoints, networks and cloud, perform incident triage, respond to complex security events and communicate findings to technical and non-technical stakeholders while facilitating tabletop exercises.

Qualifications

• 2–3 years hands-on DFIR or incident response experience.
• Strong experience with BEC incidents and triage.
• Experience in on-premise and cloud forensic investigations.
• Proficient with EDR, SIEM and forensic tools.
• Excellent communication and client-facing skills.

Responsibilities

• Lead and supervise digital forensic investigations across endpoint, network, cloud and enterprise environments.
• Conduct incident triage, investigation, containment, eradication and remediation activities.
• Investigate Business Email Compromise (BEC) incidents, including compromised accounts, phishing and mailbox access.
• Analyse forensic evidence, logs and endpoint activity to determine root cause and impact.
• Perform live endpoint investigations and collect artefacts for offline analysis.
• Utilise EDR, SIEM and other security technologies to investigate suspicious activity.
• Develop incident reports and remediation recommendations.
• Contribute to post-breach improvements of procedures and playbooks.

Skills

DFIR analyst

Incident response

BEC investigations

Client engagement

Analytical thinking

Communication skills

Education

Bachelor's degree in Cyber Security/CS

Tools

EDR tools

SIEM platforms

Forensic tooling

Job description

Launch Recruitment - IT Recruiting – Melbourne VIC

Permanent

Remote

1d ago , from Launch Recruitment - IT Recruiting

Digital Forensics & Incident Response (DFIR) Analyst

Location: RemoteEmployment Type: Permanent, Full-Time

The Opportunity

Launch Recruitment is partnering with a global cyber security organisation specialising in Digital Forensics and Incident Response (DFIR) to recruit an experienced DFIR Analyst.

This is a highly technical, client-facing opportunity for someone who thrives on investigating cyber security incidents, identifying the root cause of security breaches and helping organisations respond to and recover from cyber attacks. We are particularly interested in candidates with strong hands‑on experience investigating Business Email Compromise (BEC) incidents, conducting incident triage and managing complex digital forensic investigations.

Beyond the technical responsibilities, this role requires someone who is confident engaging directly with clients, explaining complex security incidents to both technical and non-technical audiences, and facilitating incident response tabletop exercises.

You'll work as part of a global incident response team, supporting clients across a range of industries and helping strengthen their cyber security resilience.

Key Responsibilities

Digital Forensics & Incident Response

• Lead and support digital forensic investigations across endpoint, network, cloud and enterprise environments.
• Conduct incident triage, investigation, containment, eradication and remediation activities.
• Investigate Business Email Compromise (BEC) incidents, including compromised accounts, phishing attacks, email fraud and unauthorised mailbox access.
• Analyse forensic evidence, security logs and endpoint activity to determine the root cause, scope and impact of security incidents.
• Perform live endpoint investigations, collect forensic artefacts and conduct offline forensic analysis where required.
• Utilise EDR, SIEM and other security technologies to investigate suspicious activity and support incident response.
• Develop detailed incident reports, investigation findings and remediation recommendations.
• Contribute to the ongoing improvement of incident response procedures, investigation methodologies and post-breach remediation processes.

Client Engagement & Incident Response Readiness

• Act as a key technical contact for clients throughout security investigations, providing clear updates, findings and recommendations.
• Facilitate and participate in client-facing incident response tabletop exercises, helping organisations assess their readiness and identify gaps in their response capabilities.
• Confidently present technical findings and investigation outcomes to clients, including senior stakeholders and non-technical audiences.
• Work closely with clients to understand their environments, assess security incidents and recommend practical remediation strategies.
• Support clients in developing and improving incident response plans, procedures and overall cyber resilience.
• Collaborate with internal technical teams and external stakeholders to coordinate effective incident response activities.

Essential Skills & Experience

• Demonstrated hands‑on experience in Digital Forensics and Incident Response (DFIR), ideally with a minimum of 2–3 years in a dedicated incident response or forensic investigation role.
• Strong experience investigating Business Email Compromise (BEC) incidents, including email account compromise, phishing‑related breaches and associated incident triage.
• Proven ability to investigate security incidents from initial identification through to containment, forensic analysis and remediation.
• Experience conducting forensic investigations across on‑premise and cloud environments.
• Hands‑on experience with EDR technologies, SIEM platforms and digital forensic investigation tools.
• Strong understanding of operating systems, networking, security technologies and incident response methodologies.
• Confidence facilitating or presenting incident response tabletop exercises and discussing cyber security scenarios with clients.
• Excellent communication and stakeholder engagement skills, with the ability to explain complex technical findings clearly.
• Strong analytical, problem‑solving and investigation skills.
• Ability to work independently, manage multiple investigations and remain composed during critical security incidents.

Highly Desirable

• Previous experience working in a cyber security consultancy, managed security service provider (MSSP) or client‑facing incident response environment.
• Experience investigating Microsoft 365, Exchange online and cloud‑based identity compromises.
• Familiarity with Microsoft Defender, Entra ID, Sentinel or similar investigation platforms.
• Experience developing incident response playbooks, investigation procedures or client‑facing security documentation.
• Relevant industry certifications such as GCIH, GCFE or GCFA.
• Experience contributing to incident response readiness assessments or cyber security workshops.