Our client is a fast-growing cyber security consultancy across Australia and New Zealand.
They are building the Australian arm of their Digital Forensics and Incident Response practice.
They have an immediate need for a Principal DFIR Consultant in Sydney CBD, in a newly created permanent role.
You will be the first permanent DFIR consultant on the ground in Australia, leading investigations and building the relationships that bring the work in.
You will work day to day with an established DFIR team across the Tasman, with two more hands-on hires to follow.
The role
Lead incident response engagements end to end, from scoping to final report
Hunt at scale with Velociraptor and run host, memory and log forensics
Build on relationships with cyber insurers, IR law firms and partners
Present findings to technical teams, legal counsel and executives
Help shape the trans-Tasman service, methodology and team
This is a senior practitioner role with a commercial edge,



not business development.
It offers a path to running the Australian practice.
What you'll need to succeed;
8+ years in cyber security, with a substantial DFIR component
Senior, hands-on incident response experience, ideally in a consultancy or MSSP
Confidence working independently as the senior DFIR practitioner onshore
Transparent report writing, and able to explain findings to non-technical audiences
Eligible for an Australian security clearance; Baseline is sponsored
CrowdStrike and Microsoft Defender for Endpoint experience is highly regarded
GCFA, GCFE, GCIH or similar is advantageous; proven experience counts more
Expert witness experience is desirable
Suitably skilled candidates are encouraged to apply with an achievement-based CV.

📌 Principal Dfir Consultant (New South Wales)
🏢 The Cache Group
📍 New South Wales