We have an exciting opportunity for a hands-on Cyber Investigations Manager to join Downer's Cyber Defence function. Based in Sydney, this role leads complex cyber investigations, coordinates digital forensic activities and helps strengthen our incident response capability across the enterprise.

This is a practical leadership role for someone who enjoys investigation work, evidence-led analysis, stakeholder engagement and developing capability in teams. Previous formal people leadership experience is valued, but not essential. We also welcome candidates who have demonstrated mentoring, coaching or technical leadership in cyber security, investigations or digital forensics environments.

Reporting to the Head of Cyber Defence, you will help ensure investigation outcomes are timely, defensible and aligned to business priorities, legal and privacy expectations, and Downer's cyber security strategy.

About the Role
In this role you will:

- Lead complex cyber investigations and coordinate digital forensic activities across the organisation.
- Manage investigation activities for escalated cyber security incidents, including determining scope, business impact, root cause, and remediation requirements.
- Ensure evidence is collected, handled, documented, and retained in accordance with agreed procedures and governance requirements.
- Translate technical findings, forensic evidence and security artefacts into clear investigation conclusions and actionable recommendations.
- Coordinate across internal teams and external specialists during sensitive or high-profile investigations.
- Drive lessons learned from investigations into improved security controls, detection capabilities, incident response playbooks and remediation programs.
- Provide leadership, coaching and direction to the Investigation & Forensics Analyst while fostering a culture of continuous improvement and knowledge sharing.
- Manage relationships with security vendors, managed security service providers (MSSPs) and specialist investigation partners to support effective investigation outcomes.
- Deliver stakeholder-ready reporting and communicate sensitive findings appropriately to technical, business and executive audiences.
- Contribute to the ongoing maturity of Downer's cyber defence capability through process enhancement, training, exercises and operational improvements.

This is a hands-on role where you will combine technical expertise,



investigative judgement and clear communication to support sensitive decisions, improve investigation quality and strengthen Downer's cyber resilience over time.

Our Ideal Candidate
You are a proactive cyber investigator or digital forensics professional who enjoys solving complex problems, working through evidence and helping others build confidence and capability. You can move between technical detail and business context, and you are comfortable communicating sensitive findings with care, clarity and discretion.

You bring sound judgement, strong attention to detail and a collaborative style. You are curious, practical and improvement-focused, with the confidence to lead investigations and the humility to keep learning.

What You Will Bring

- Experience conducting, managing or coordinating cyber security investigations, digital forensics or incident response activities in complex environments.
- Hands-on technical investigation skills, including analysis of security events, endpoint and identity activity, network artefacts, logs, alerts, email evidence and cloud or SaaS activity where relevant.
- Practical understanding of digital forensics principles, evidence handling, chain of custody, investigation documentation and defensible reporting.
- Experience using, coordinating or drawing insight from security tooling such as SIEM platforms, EDR or XDR tools, email security platforms, vulnerability management tools, ticketing or case management systems, and forensic or eDiscovery tooling.
- Ability to translate technical findings, forensic artefacts and threat context into clear conclusions, risk-based recommendations and stakeholder-ready reporting.

Experience working closely with a diverse set of stakeholders across Cyber Security, Technology, Legal, HR, Risk, Privacy, business leaders and external partners during sensitive, ambiguous or high-pressure matters.

- Working knowledge of cyber security frameworks, controls and service management practices, such as NIST, ISO/IEC 27001, ASD Essential Eight, ITIL-aligned processes and incident response playbooks.




- Demonstrated experience mentoring, coaching, guiding or developing others. Formal people leadership experience is welcome, but not essential.
- Experience managing security tooling, vendors, managed security service providers or specialist investigation partners is desirable.
- A degree in cyber security, computer science, information technology, management information systems or equivalent practical experience.
- Relevant certifications such as CISSP, CISM, CISA, CRISC, CompTIA Security+, digital forensics, incident response or investigation-related certifications are desirable, but not mandatory.

Benefits Of Working with Downer

- Work with an ASX listed company, working with market leaders.
- Grow your career with us, we are passionate about giving our people opportunities to grow through personal and professional development and continuous learning:
- Professional development programs
- Access to professional memberships and industry networks

- Be part of a team that cares, we foster a work environment built on support that is flexible around our employee's wellbeing needs:

- Flexible work arrangements
- Parental leave
- Employee Assistance Program
- Programs promoting diversity and inclusion

- A range of Corporate Perks, including:

- Discounted services (car hires, hotels, insurance, retail stores, gyms)

Why Downer?
As a trusted name in infrastructure, transport, facilities management, and construction, Downer is committed to delivering projects that create a lasting, positive legacy. We're committed to building a team that reflects the diverse communities we serve, and we welcome people of all ages, genders, sexual orientations, cultures, abilities, and lived experiences.

We especially encourage applications from those whose voices have traditionally been underrepresented in our industry, including women, Aboriginal and Torres Strait Islander Peoples, Māori and Pasifika Peoples, veterans, people with disability, and neurodivergent individuals. Even if your experience doesn't align perfectly with this role, we'd still like to hear from you. If it feels like the right fit, apply - potential counts, and so do you.

As a WORK180 Endorsed Employer, we support flexibility that works for your life, inclusive leadership that values your voice, and equitable access to opportunity so you can do your best work and bring your whole self to it.

📌 Cyber Investigations Manager (Sydney)
🏢 Downer Edi
📍 Sydney