Senior DFIR Analyst

Cache Group; Sydney; On-site; AUD 120,000 - 180,000; Full time

Job summary

Cache Group is seeking a Senior DFIR Analyst to join its Australian arm. You will lead end-to-end incident response engagements, handling ransomware, BEC and malware cases, and you will collect evidence, perform in-depth host/memory/log analysis, and produce clear findings for diverse readers.

This hands-on role requires 3–5 years of DFIR experience, proficiency with EDR/forensic tools, and the ability to obtain Australian Baseline security clearance.

Qualifications

• 3–5 years hands-on DFIR experience.
• Hands-on with EDR and forensic tooling.
• Clear written reports for technical and non-technical readers.
• Eligible for Australian Baseline security clearance and police check.
• Certifications such as GCFA/GCFE/GCIH/CCFR/SC-200 are advantageous; proven experience counts more.

Responsibilities

• Lead smaller incident response engagements from scoping to final report.
• Respond to ransomware, BEC, malware and insider threat cases.
• Collect and preserve evidence; run host, memory and log analysis.
• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint.
• Write clear findings and reports for technical and non-technical readers.
• This is hands-on investigation, not alert monitoring.

Skills

DFIR experience

EDR tooling

Clear reporting

Scripting (Python/PowerShell)

Cloud investigations

Clearance eligibility

Education

GCFA

GCFE

GCIH

CCFR

SC-200

Tools

CrowdStrike

Defender for Endpoint

Velociraptor

Job description

Our client is a fast-growing cyber security consultancy across Australia and New Zealand. They are building the Australian arm of their Digital Forensics and Incident Response practice.

They have an immediate need for a Senior DFIR Analyst in a permanent role, with a choice of city across Australia.

You will work on live investigations alongside an established DFIR team across the Tasman, and lead smaller engagements end to end.

The role

Lead smaller incident response engagements from scoping to final report

Respond to ransomware, business email compromise, malware and insider threat cases

Collect and preserve evidence; run host, memory and log analysis

Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint

Write clear findings and reports for technical and non-technical readers

This is hands-on investigation, not alert monitoring.

What you'll need to succeed;

About 3 to 5 years hands-on in DFIR

Hands-on with EDR and forensic tooling

Clear written reports for technical and non-technical readers

Eligible for an Australian Baseline security clearance and able to pass a police check

GCFA, GCFE, GCIH, CCFR or SC-200 advantageous; proven experience counts more

Python or PowerShell scripting, and Microsoft 365 or cloud investigations, are a plus