Digital Forensic Analyst

Triskele Labs; Los Angeles (CA); Remote; USD 70,000 - 100,000; Full time

Job summary

Triskele Labs is seeking a DFIR Analyst to lead incident response engagements. This fully remote role involves conducting investigations, presenting findings, and providing expert guidance during cyber incidents. Join a forward-thinking team committed to improving cybersecurity for clients across the globe.

Benefits

Collaborate with C-Suite executives

Career advancement opportunities

New office in Melbourne CBD

Frequent team events

Qualifications

• 1+ years of DFIR experience.
• Strong forensic investigation skills with experience in chain of custody.
• Ability to work independently and collaboratively across teams.

Responsibilities

• Conduct DFIR investigations across diverse environments.
• Present technical findings to both technical and non-technical audiences.
• Develop targeted threat hunts tailored to client industries.

Skills

Analytical

Communication

Interpersonal

Education

GIAC Certified Forensic Examiner (GCFE)

GIAC Certified Forensic Analyst (GCFA)

GIAC Certified Incident Handler (GCIH)

Tools

SentinelOne

Crowdstrike

Microsoft Defender

Carbon Black

Elastic

Rapid7

Microsoft Sentinel

Magnet Axiom

KAPE

Velociraptor

Job description

Triskele Labs are one of the leading providers of cybersecurity services in Australia. We assist clients to reduce their risk of a cyber compromise through the delivery of risk-considered controls.

Triskele Labs are one of the last remaining boutiques in Australia. We are currently the largest CREST Registered Penetration Testing company in Melbourne and one of the only boutiques to run a 24x7x365 Security Operations Team completely onshore.

The Triskele Labs Digital Forensics and Incident Response (DFIR) team assists clients of all sizes to prevent and respond to cyber-attacks. Our team has responded both in person and remotely to incidents across Australia and the world. We get clients back online quickly, determine the root cause of an incident and find out if data has been compromised.

As an end-to-end cyber security provider, the DFIR team can also draw on experts across the organisation including offensive and defensive cybersecurity specialists. We investigate and analyse breaches to determine the root cause and implement controls to contain the incident. All DFIR is backed by a professional report for clients that outlines all findings and recommendations.

Requirements

We are seeking a DFIR Analyst to lead and support incident response engagements from initiation to closure across legal, insurance, retainer, and SOC escalation channels. You'll provide expert advice to clients during high-pressure situations, prioritising workload based on incident criticality and team direction.

Key Responsibilities:

• Conduct Digital Forensics and Incident Response (DFIR) investigations across diverse environments, including crisis support outside normal hours
• Present technical findings clearly to both technical and non-technical audiences
• Perform forensic analysis on images, logs, and malware samples (static and dynamic analysis)
• Develop targeted threat hunts tailored to client industries
• Document procedures, findings, and improve internal methodologies
• Provide expert guidance and calm leadership during incidents
  
  
  

What We're Looking For:

• 1+ years of DFIR experience
• Proven understanding of the incident response lifecycle and attacker TTPs
• Strong forensic investigation skills with experience in chain of custody, malware analysis, and investigation protocols
• Excellent analytical, communication, and interpersonal skills
• Ability to work independently, remotely, and collaboratively across teams
  
  
  

Technical Skills:

• Experience with EDR tools: SentinelOne, Crowdstrike, Microsoft Defender, Carbon Black
• Familiarity with SIEM platforms: Elastic, Rapid7, Microsoft Sentinel
• Use of forensic tools like Magnet Axiom, KAPE, Velociraptor, HAWK, Volatility, Hayabusa, and Chainsaw
  
  
  

Highly Regarded Certifications:

• GIAC Certified Forensic Examiner (GCFE)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Incident Handler (GCIH)
• Magnet Axiom or equivalent tool certification
• SpectreOps - Adversary Tactics: Detection
  
  
  

Benefits

Team culture is everything to Triskele Labs and it is the reason we exist. We are a forward-thinking company and always looking for ways to boost our team culture to ensure we are a destination employer. We continually undertake surveys to seek feedback from our team on ways we can improve our work environment and team member experience at Triskele Labs.

We provide our team a great range of additional benefits such as:

• Collaborate closely with C-Suite executives and gain insights from top industry leaders
• Help influence the DFIR Team's direction while advancing your own career
• Enjoy a brand-new office located in the heart of Melbourne CBD
• Frequent events organised by our People & Culture Team
  
  

Working Arrangements:

The role is fully remote, and are looking for someone located from any state with America.

Seniority level

• Seniority level

  Associate

Employment type

• Employment type

  Full-time

Job function

• Job function

  Other, Information Technology, and Management

• Industries

  IT Services and IT Consulting

Referrals increase your chances of interviewing at Triskele Labs by 2x

Sign in to set job alerts for “Forensic Analyst” roles.

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.