DFIR Analyst

Forensic Focus Limited; New Zealand; Remote; NZD 80,000 - 105,000; Full time

Job summary

Forensic Focus Limited is seeking a DFIR Analyst to perform digital forensic investigations and incident response across endpoints, networks, cloud, and SaaS environments. You will handle evidence collection, chain-of-custody, containment support, and contribute to formal reports.

The ideal candidate has 2+ years in DFIR/threat hunting, proficiency with X-Ways Forensics, Axiom, and FTK, and familiarity with EDR/XDR, SIEMs, and scripting. A consulting mindset and on-call rotation are a plus.

Qualifications

• Two+ years of hands-on DFIR or threat-hunting experience.
• Experience with forensic tools (X-Ways Forensics, Axiom, FTK).
• Familiarity with EDR/XDR platforms, SIEMs and network forensics.
• Basic scripting or automation capabilities.

Responsibilities

• Conduct digital forensic investigations and incident response across endpoints, networks, cloud and SaaS.
• Manage evidence acquisition and chain-of-custody.
• Prepare investigative reports and customer-facing status updates.

Skills

DFIR

Threat Hunting

EDR/XDR

SIEM

Windows Artifacts

Scripting

Education

Cybersecurity Degree

Tools

X-Ways Forensics

Axiom

FTK

Job description

# DFIR Analyst*SentinelOne***Auckland**Mid · Full-time### The RoleThe analyst conducts digital forensic investigations and incident response across endpoint, network, cloud, and SaaS environments, covering ransomware, business email compromise, and identity compromise cases. Responsibilities include evidence acquisition, chain-of-custody management, containment support, case documentation, and contributing to customer-facing status updates and formal investigative reports.### Skills & ExperienceCandidates need two or more years of hands-on DFIR or threat-hunting experience, ideally in a consulting environment. Proficiency with forensic tools such as X-Ways Forensics, Axiom, and FTK is expected, alongside familiarity with EDR/XDR platforms, SIEMs, network forensics, Windows artifact analysis, and scripting or automation capabilities.### Who It SuitsThis role suits an early-to-mid career DFIR professional who thrives in fast-paced, high-pressure environments and is comfortable working a rotating on-call schedule. Those with a degree in digital forensics or cybersecurity and a consulting background will be well positioned to contribute across multi-region investigations.Compare Incident Response salaries in New Zealand →Learn More/Apply