Digital Forensics Expert

About the Role

We're seeking a highly skilled and experienced professional to join our Cybersecurity Incident Response Team as a Senior Cybersecurity Incident Responder.

This role is responsible for delivering digital forensics & incident response (DFIR) engagements, and proactive advisory services such as tabletop exercises, compromise assessments & threat hunting, breach readiness assessments, threat intelligence briefings, & threat modelling.

You'll be leading DFIR engagements across either Australia or New Zealand, working closely with stakeholders to investigate and resolve complex security incidents.

• Conduct thorough investigations into major security incidents, determining root causes, impact, and mitigation strategies. Provide expertise and support to contain, eradicate, and recover from such security incidents.
• Analyze affected systems using forensic techniques to examine system events and adversary activities.
• Utilize security tooling such as EDR, SIEM, XDR, & Identity technologies to assist in investigation of confirmed or suspected compromises.
• Undertake log & correlation analysis and construct a timeline of adversary activities.
• Identify intrusion vectors & root causes and develop recommendation actions to prevent similar incidents.
• Collect digital forensics evidence from affected systems in accordance with industry standards for image acquisition and preservation of digital evidence.
• Produce comprehensive, detailed DFIR reports outlining investigative steps undertaken, findings, and recommendations.
• Support containment, eradication and recovery efforts based on available information and established processes.
• Analyze incident response effort, with feedback from customers and third parties as part of Post Incident Reviews (PIRs) and Lessons Learned.
• Deliver proactive incident response services including tabletop exercises, threat hunting, compromise assessments, breach readiness assessments, threat intelligence briefings, and threat modelling.
• Communicate effectively with senior stakeholders within Datacom and its customers.
• Collaborate with other members of the CSIRT team to develop technical capabilities, improve processes and technology to deliver successful outcomes to customers and stakeholders.
• Participate in an on-call roster for major incident response.
• Occasional planned or last-minute/urgent travel may be required for customer-facing engagements.

• Root cause analysis and mitigation strategy development.
• Forensic analysis and evidence collection.
• Incident response and containment.
• Post-incident review and lessons learned.
• Proactive advisory services.
• Communication and collaboration with stakeholders.

• Confidence in communicating with senior stakeholders in difficult situations.
• Proven experience responding to high-profile cybersecurity incidents with significant operational or privacy impacts.
• Digital forensics & incident response (DFIR) experience with understanding of key system & digital forensic artifacts.
• Experience using DFIR tools such as EnCase, X-Ways, Magnet Axiom, Velociraptor, KAPE, & THOR.
• Knowledge of current and emerging attacker behaviors, tools, tactics, and techniques.
• Understanding of various security frameworks and methodologies.
• Desirable: SANS GCFA, GCFE, GCIH, or relevant DFIR certifications.

Datacom is one of Australia and New Zealand's largest suppliers of Information Technology professional services, maintaining a dynamic, agile small business feel. Our unique culture and energy make us an attractive employer. We care about our people, providing social events, chill-out spaces, remote working, flexi-hours, and professional development courses. You'll have opportunities to learn, develop your career, connect, and bring your true self to work. You'll be recognized and valued for your contributions in a collegial, flat-structured environment.

We operate at the forefront of technology to help Australia and New Zealand's largest enterprise organizations explore possibilities and solve their greatest challenges. You'll never run out of interesting new challenges and opportunities.

We're committed to fostering a positive and inclusive work environment where everyone feels valued and supported. If you're passionate about making a difference in the field of cybersecurity, we encourage you to apply for this exciting opportunity.