Digital Forensics & Incident Response (DFIR) Consultant

Brisbane | Sydney | Melbourne | Hybrid | Permanent

We're partnering with one of Australia's leading cyber consulting teams to expand their Digital Forensics & Incident Response practice. This is an opportunity to work on high-profile cyber investigations, major incident response engagements, insider threat cases and complex digital forensic matters for enterprise and government clients.

No two days are the same. One week you could be responding to a ransomware incident, the next conducting forensic analysis in support of litigation or investigating business email compromise, data theft or insider activity.

What you'll be doing

- Lead and support digital forensic investigations across Windows, macOS, Linux and cloud environments.

- Respond to cyber security incidents including ransomware, business email compromise, insider threats and data breaches.

- Collect, preserve and analyse digital evidence while maintaining strict chain of custody.

- Conduct endpoint, server, cloud and mobile forensic examinations.

- Analyse forensic artefacts, logs and malware indicators to determine attack timelines and root cause.

- Produce clear technical reports and present findings to clients and legal stakeholders.

- Work alongside threat intelligence, cyber security and legal teams on complex investigations.

- Support clients before, during and after cyber incidents with remediation recommendations.





What we're looking for

- Experience in Digital Forensics, Incident Response, Cyber Investigations or eDiscovery.

- Hands-on experience with forensic and IR tools such as CrowdStrike Falcon, FTK, EnCase, Magnet AXIOM, Cellebrite, Velociraptor, X-Ways, Microsoft Defender or similar.

- Solid understanding of Windows artefacts, file systems, memory analysis and forensic methodologies.

- Knowledge of attack techniques, MITRE ATT&CK; and incident response frameworks.

- Excellent report writing and communication skills.

- Ability to work under pressure during active cyber incidents.

Highly regarded

- GIAC (GCFA, GCIH, GCFE)

- EnCE

- Magnet certifications

- Cellebrite certifications

- Security clearance (Baseline, NV1 or above)

- Experience supporting litigation or regulatory investigations.

What's on offer

- Work on some of Australia's most complex cyber investigations.

- Genuine career progression within a growing DFIR practice.

- Ongoing training, certifications and conference support.

- Exposure to enterprise, government and critical infrastructure environments.

- Flexible hybrid working arrangements.

- Competitive salary plus bonus opportunities.

If you're looking to move beyond BAU security operations and into hands-on investigations that make a real impact, we'd love to have a confidential conversation.

📌 DFIR Consultant - Manager (Sydney)
🏢 Paisley Consulting
📍 Sydney