About The Role The Digital Forensics and Incident Response Analyst role contributes to the overall success of the Security function by providing digital forensics capability and advanced investigations support to respond to incidents impacting the department and schools.

The role is responsible for conducting investigations into cybersecurity incidents, data breaches, insider threats, and other digital crimes. This role involves identification, acquisition, preservation, analysis, and presentation of digital evidence in a legally defensible manner.

atory requirements related to digital evidence, the role will setup and maintain a digital forensics lab.

This role requires strong reporting, analytical and problem-solving skills along with technical expertise, and the ability to work collaboratively in teams and to clearly communicate findings to technical and non-technical stakeholders.

Conduct digital forensic analysis to reconstruct cyberattack timelines and identify attacker techniques.

Respond to cybersecurity incidents across the full lifecycle: detection, containment, eradication, and recovery.

Collect and preserve digital evidence while maintaining proper chain of custody.

Maintain and improve the digital forensics lab and tools.

Use security tools (e.g., SIEM) and host-based investigations to analyse incidents.

Perform threat hunting, threat intelligence analysis, and trend forecasting.

Provide technical remediation recommendations and communicate findings.

Collaborate with external incident response teams during major incidents.

Produce technical and executive reports on investigations and threats.

Support in enhancing the organisation's overall cybersecurity posture.





About The Role The Digital Forensics and Incident Response Analyst role contributes to the overall success of the Security function by providing digital forensics capability and advanced investigations support to respond to incidents impacting the department and schools.

The role is responsible for conducting investigations into cybersecurity incidents, data breaches, insider threats, and other digital crimes. This role involves identification, acquisition, preservation, analysis, and presentation of digital evidence in a legally defensible manner.

The role also provides incident response support and technical advisory in a quick paced, high-volume and complex setting. Using enterprise Digital Forensics and Incident Response (DFIR) tools, methodologies, specialised capability and a sound understanding of legal and regul

atory requirements related to digital evidence, the role will setup and maintain a digital forensics lab.

This role requires strong reporting, analytical and problem-solving skills along with technical expertise, and the ability to work collaboratively in teams and to clearly communicate findings to technical and non-technical stakeholders.

Key Responsibilities

Conduct digital forensic analysis to reconstruct cyberattack timelines and identify attacker techniques.





Respond to cybersecurity incidents across the full lifecycle: detection, containment, eradication, and recovery.

Collect and preserve digital evidence while maintaining proper chain of custody.

Maintain and improve the digital forensics lab and tools.

Use security tools (e.g., SIEM) and host-based investigations to analyse incidents.

Perform threat hunting, threat intelligence analysis, and trend forecasting.

Provide technical remediation recommendations and communicate findings.

Collaborate with external incident response teams during major incidents.

Produce technical and executive reports on investigations and threats.

Support in enhancing the organisation's overall cybersecurity posture.

Skills & Capabilities Digital Forensics

Perform forensic analysis across Windows, Linux, macOS, and cloud environments.

Build attack timelines and investigate attack vectors, malware behaviour, lateral movement, and data exfiltration.

Capture and analyse network traffic for investigation and decryption.

Examine disk images, memory dumps, logs, and system artifacts to determine incident details.

Set up, maintain, and enhance the digital forensics lab.

Use specialised forensic tools such as EnCase, FTK, Autopsy, X-Ways, Volatility, and KAPE.

Evidence Collection & Preservation

Acquire and preserve digital evidence (disk, memory, logs, network traffic, cloud artifacts) while maintaining chain of custody, evidence integrity such that the evidence is legally defensible.

Ensure forensic soundness using proper chain‑of‑custody procedures.

Capture volatile data (RAM, running processes, network connections) when needed.

Th

📌 Digital Forensics and Incident Response Analyst (Melbourne)
🏢 Department Of Education
📍 Melbourne