About the role
Our Senior DFIR Analyst role is an exciting opportunity for those looking to go head-to-head with today's cyber criminals. We're looking for a Senior DFIR Analyst with at least 2 years' experience to lead and support investigations into Business Email Compromise (BEC), ransomware, and web application breaches. You'll drive evidence collection, containment, forensic analysis, reporting while working alongside some of the best in the field.
You'll contribute your expertise to strategy and methodology across various incident types, with a particular focus on forensic investigations into complex cyber incidents. You'll operate confidently both independently and as part of a team, working across the full operational flow and attack chain of security incidents to help our clients respond to cyber attacks and other investigations.
Gridware responds to a broad range of incidents, including Business Email Compromise, insider threat and employee misconduct, cloud and network compromise, ransomware, and data extortion.
What you'll do
Collect and preserve evidence
Conduct host-based and network-based forensics
Perform malware analysis
Review cloud and application logs
Use industry best-practice tools for log ingestion, threat hunting, and Endpoint Detection and Response, including KAPE, AXIOM, SOF-ELK, Velociraptor, CrowdStrike, and SentinelOne
What we're looking for
Hands-on experience with CrowdStrike Falcon for endpoint investigation, threat hunting, and incident containment,



including using Real Time Response (RTR) to support forensic evidence collection and response activities
Real-world experience in incident response, digital forensics, or a security operations centre
Demonstrated technical capability with digital forensics tools, particularly on Windows systems (experience with Linux and macOS investigations is a plus)
An autonomous, critical thinker with a positive attitude and a team-first mindset
General cyber security knowledge, including an understanding of the threat landscape, threat actor groups, and playbooks
Strong communication skills, able to convey technical concepts to a broad range of audiences
Certifications such as GCFE, GCFA, or GCIH are helpful in demonstrating capability but not essential
Why Gridware
Flexible, remote-friendly environment, work fully remote, or from our A-grade office in Australia Square in the heart of Sydney's CBD
Great Place to Work certified and Top 10 Best Workplace in Australia **** & ****
Exposure to high-impact, high-urgency incidents across industries
A flexible, remote-friendly workplace — we're DFIR operators and we understand that work can be busy, but so can life
Variety of casework: Gridware responds to a high volume of incidents, so no two days are the same
Strong learning and development culture: a collaborative team of innovators with access to leading tooling, training, and thought leadership
Mental health days and flexible working arrangements
#J-*****-Ljbffr

📌 Senior Dfir Analyst (Newcastle)
🏢 Gridware
📍 Newcastle