Principal Analyst - Digital Forensics & Incident Response

Sydney, NSW

· Full time / Permanent

· ForensicIT

About Us

Infotrust is one of Australia’s leading cyber security and technology services companies. We help organisations secure their future - protecting people, data and systems through specialist expertise across managed technology, cyber, cloud, consulting and data protection. We’re growing fast, and our people are at the heart of everything we do.

The Role

Forensic IT is seeking an experienced and highly motivated Principal Analyst to join our Digital Forensics & Incident Response (DFIR) team.

As a Principal Analyst, you’ll bring deep expertise across core DFIR fundamentals — with the ability to clearly articulate not only what decisions you made and how you reached them, but crucially why those decisions are sound and defensible. You’ll lead our most complex investigations and help shape the direction of the practice.

Key Responsibilities

- Lead complex investigations and casework, including high-impact cyber incidents at the forefront of the discipline.
- Provide definitive written and oral advice on complex, sensitive or contentious forensic matters, and set casework acceptance criteria.
- Direct leading-edge research and develop techniques, tools and strategies that advance DFIR practice.
- Establish technical and professional standards, service delivery models and internal training standards for the team.




- Manage and lead complex multidisciplinary projects, engaging internal and external stakeholders.
- Contribute to business development and market engagement across law firms, corporate legal teams, insurers and referral partners.

Skills & Experience

- Minimum 8 years’ hands-on DFIR experience across Windows, macOS, Linux/Unix, cloud (M365, AWS, Azure) and mobile (iOS/Android).
- Forensic acquisition and analysis of file systems, memory and core artefacts.
- SIEM/EDR data interpretation (e.g. ELK, Splunk, CrowdStrike) and cloud-native investigations.
- Scripting capability (Python, PowerShell, Bash) for automation and evidence processing.
- Confident communicator, comfortable justifying expert opinion to stakeholders and in court.
- Detail-oriented, calm under pressure and collaborative, with a strong client-service ethic.

Highly Regarded

- GIAC Certified Forensic Analyst (GCFA) or Certified Forensic Computer Examiner (CFCE).
- Prior expert-witness / courtroom experience.
- Ability to obtain NV1 security clearance.

Why Infotrust

- A high-growth, people-first culture where your work has genuine impact.
- Ongoing investment in your development - certifications, training and clear career pathways.
- Work alongside some of the best specialists in the Australian market.
- Flexible, hybrid working and a supportive, collaborative team workplace.

📌 Principal Analyst (Sydney)
🏢 InfoTrust
📍 Sydney