Senior DFIR Investigator & Incident Response Lead

Forensic Focus; Sydney; Remote; AUD 108,000 - 138,000; Full time

Job summary

Forensic Focus in Australia is seeking a Senior DFIR Analyst to lead investigations into business email compromise, ransomware, and web application breaches. You will oversee evidence collection, preservation, and perform host and network forensics, malware analysis, and log reviews across the complete incident response lifecycle.

The role requires at least two years in DFIR or SOC, strong Windows forensics, and familiarity with DFIR tools such as KAPE, AXIOM, SOF-ELK, Velociraptor, CrowdStrike

Qualifications

• Two years hands-on DFIR or SOC experience.
• Strong Windows forensic skills.
• Familiar with listed DFIR tools (KAPE, AXIOM, SOF-ELK, Velociraptor, CrowdStrike Falcon, SentinelOne).

Responsibilities

• Lead and support investigations into business email compromise, ransomware, and web application breaches.
• Collect and preserve evidence across cases.
• Perform host and network forensics and malware analysis.
• Review cloud and application logs across the full incident response lifecycle.

Skills

Two years DFIR or SOC experience

Windows forensics

Incident response

Familiar with DFIR tooling

Tools

KAPE

AXIOM

SOF-ELK

Velociraptor

CrowdStrike Falcon

SentinelOne

Job description

Forensic Focus in Australia is seeking a Senior DFIR Analyst to lead investigations into business email compromise, ransomware, and web application breaches. You will oversee evidence collection, preservation, and perform host and network forensics, malware analysis, and log reviews across the complete incident response lifecycle.

The role requires at least two years in DFIR or SOC, strong Windows forensics, and familiarity with DFIR tools such as KAPE, AXIOM, SOF-ELK, Velociraptor, CrowdStrike