Senior DFIR Analyst: Lead Live Investigations & Reports

Cache Group; Sydney; On-site; AUD 120,000 - 180,000; Full time

Job summary

Cache Group is seeking a Senior DFIR Analyst to join its Australian arm. You will lead end-to-end incident response engagements, handling ransomware, BEC and malware cases, and you will collect evidence, perform in-depth host/memory/log analysis, and produce clear findings for diverse readers.

This hands-on role requires 3–5 years of DFIR experience, proficiency with EDR/forensic tools, and the ability to obtain Australian Baseline security clearance.

Qualifications

• 3–5 years hands-on DFIR experience.
• Hands-on with EDR and forensic tooling.
• Clear written reports for technical and non-technical readers.
• Eligible for Australian Baseline security clearance and police check.
• Certifications such as GCFA/GCFE/GCIH/CCFR/SC-200 are advantageous; proven experience counts more.

Responsibilities

• Lead smaller incident response engagements from scoping to final report.
• Respond to ransomware, BEC, malware and insider threat cases.
• Collect and preserve evidence; run host, memory and log analysis.
• Hunt with Velociraptor and contain with EDR such as CrowdStrike or Defender for Endpoint.
• Write clear findings and reports for technical and non-technical readers.
• This is hands-on investigation, not alert monitoring.

Skills

DFIR experience

EDR tooling

Clear reporting

Scripting (Python/PowerShell)

Cloud investigations

Clearance eligibility

Education

GCFA

GCFE

GCIH

CCFR

SC-200

Tools

CrowdStrike

Defender for Endpoint

Velociraptor

Job description

Cache Group is seeking a Senior DFIR Analyst to join its Australian arm. You will lead end-to-end incident response engagements, handling ransomware, BEC and malware cases, and you will collect evidence, perform in-depth host/memory/log analysis, and produce clear findings for diverse readers.

This hands-on role requires 3–5 years of DFIR experience, proficiency with EDR/forensic tools, and the ability to obtain Australian Baseline security clearance.