Every engagement our DFIR team takes on starts with the same question from a client: what happened, how far did it go, and can you prove it. This role exists to answer that question with evidence that stands up to a board, an insurer, a regulator or a court.

About Triskele Labs

Triskele Labs is an Australian sovereign, independent, founder-owned cybersecurity business on a journey to be a leading provider of cybersecurity services done properly, built on purpose, culture and mission. We work across Government, Corporate and Enterprise, APRA regulated and highly regulated sectors, while continuing to support the mid-market. Our DFIR practice is fully onshore, delivering incident response, retainer and readiness services alongside a 24x7 Managed Detection and Response capability.

About the role

From day one you will be on live incidents including Ransomware, BEC, Unauthorised Access and more. You will acquire and preserve evidence, build the timeline, establish root cause and scope, and produce reports that non-technical executives and their lawyers rely on to make decisions. You will work directly with our incident responders, panel law firms and insurers, with the backing of a fully onshore team and the tooling to do the job properly. As you settle in, you will shape our forensic playbooks, mentor junior analysts and become the person panel partners trust to get the facts right.

What you will do

- Own evidence acquisition and preservation across endpoints, servers, cloud tenants (Microsoft 365, Azure, AWS) and mobile devices, maintaining chain of custody throughout
- Conduct disk, memory,



log and cloud forensic analysis to reconstruct attacker activity, establish initial access, lateral movement, persistence and data exfiltration
- Perform data impact assessments to support notification decisions under the Privacy Act and the SOCI Act
- Write explicit, defensible forensic reports and present findings to executives, legal counsel, insurers and, where required, law enforcement
- Support containment and recovery alongside our incident responders and SOC analysts
- Contribute to retainer and readiness work including tabletop exercises, compromise assessments and forensic readiness reviews
- Improve our forensic tooling, automation and case documentation standards

What we are looking for

Required

- 3 or more years of hands-on digital forensics or incident response experience, with cases you have personally worked from acquisition through to reporting
- Demonstrated experience with industry forensic tooling such as EnCase, FTK, X-Ways, Magnet AXIOM, Velociraptor, KAPE, Plaso or Volatility
- Experience investigating Windows environments, including Active Directory attack paths, and at least one major cloud platform
- Written forensic reports that have been relied upon by clients,



legal teams or insurers
- Australian citizenship (required for the Government work this role supports)

Preferred

- GCFA, GCFE, GNFA, GREM, CHFI or equivalent certification
- Experience giving evidence or producing reports for litigation or regulatory proceedings
- Malware triage or reverse engineering skills
- Experience with ransomware negotiation support, business email compromise or insider threat investigations
- Scripting in Python or PowerShell for artefact parsing and automation

What it is like

Incident response is unpredictable. There will be weeks that are calm and weeks where you are on a bridge call at 2am with a client whose business is down. We run a rostered on-call model, we rotate people off active cases to recover, and we invest in training and certifications every year. If you want to do serious forensic work on real Australian incidents, with a team that is entirely onshore and takes the craft seriously, this is the place.

Why join

- A sovereign Australian team working on the incidents that matter to Australian organisations
- Direct exposure to executives, boards, legal counsel and insurers from day one
- Annual training and certification budget
- Clear progression into senior analyst and lead investigator roles
- Melbourne CBD office with hybrid working

How to apply

Apply via LinkedIn with your CV and a short note on a case you are proud of (anonymised).

Triskele Labs is an equal opportunity employer and welcomes applications from people of all backgrounds.

📌 Digital Forensics Analyst (Melbourne)
🏢 Triskele Labs
📍 Melbourne