Job Overview & Organization Mission

Investigate sophisticated cyber breaches, ransomware attacks, and insider threats, recovering digital evidence to help Australian enterprises recover safely.

CyberCX is looking for an experienced DFIR Consultant to join our National Incident Response team in Sydney. When cyber crises strike, you will lead the tactical triage, disk and memory forensics, timeline reconstruction, and threat eradication for Australian organizations facing active extortion and sophisticated intrusions.

As a key member of the team at CyberCX in Sydney, NSW, you will play a central role in driving excellence, upholding top-tier Australian industry standards, and contributing directly to the strategic milestones of one of the nation’s premier employers.

Key Duties & Core Responsibilities

In this critical role, your operational duties and key performance responsibilities will encompass:

• Deploy rapidly: Deploy rapidly to contain live ransomware attacks, business email compromises (BEC), and state-sponsored intrusions.
• Perform forensic: Perform forensic imaging and forensic analysis on Windows, Linux, and macOS endpoints and servers.
• Analyze volatile: Analyze volatile system memory (RAM), master file tables ($MFT), event logs, and cloud audit logs.
• Reconstruct breach: Reconstruct breach timelines and establish the root cause, scope of compromise, and data exfiltration footprint.
• Author expert: Author expert forensic reports admissible in legal proceedings and deliver briefings to C-suite and legal counsel.

Required Qualifications, Licenses & Experience

To be successful in this position at CyberCX, candidates are expected to satisfy the following essential selection criteria:

• Mandatory Qualification: Degree in Digital Forensics, Cybersecurity, Law/Criminology or certifications (GCFA, GCFE, EnCE).
• Relevant Experience: Minimum 4+ Years of verified industry experience in Australia or recognized overseas equivalence.
• 4+ years of practical digital forensics and incident response experience in a dedicated consultancy or law enforcement unit.
• Proficiency with forensic tools such as EnCase, FTK, X-Ways, Volatility, KAPE, and forensic timeline generators.
• Deep knowledge of Windows forensic artifacts (Shimcache, Amcache, Prefetch, Shellbags, USN Journal).
• Hold GIAC Certified Forensic Analyst (GCFA), GCFE, or equivalent industry accreditation.

Core Competencies & Key Technical Proficiencies

The successful applicant will possess demonstrated capabilities across the following domain skill sets:

Salary, Compensation & Employee Benefits

At CyberCX, we understand that our people drive our achievements. An outstanding remuneration and wellbeing package is provided in line with Australian benchmarks:

• Competitive Remuneration: AU$145,000 – AU$175,000 per year + standard Australian Superannuation (11.5%).
• Remuneration $145,000 – $175,000 + incident response on-call bonuses.
• Sydney CBD headquarters with hybrid working model and high-spec forensic workstation equipment.
• High-impact work protecting Australia’s national economy with top cyber investigators.
• Leave Entitlements: 4 weeks annual leave (with 17.5% annual leave loading where applicable) plus 10 days paid personal/carer’s leave.
• Flexible Work: Progressive work-life balance options with supportive corporate culture and leadership development pathways.

About the Employer: CyberCX

CyberCX provides cyber security capabilities across governance, assurance, offensive security, and emergency incident response.

CyberCX is deeply committed to building diverse, equitable, and culturally inclusive work environments. We proudly celebrate diversity and welcome applications from all qualified individuals including First Nations Australians, people with disabilities, and candidates from culturally and linguistically diverse backgrounds.

Application Process & Next Steps

Applications for this position are currently open and being reviewed on a rolling basis. Suitable candidates are encouraged to apply as early as possible before the published closing date.

Please prepare an updated Curriculum Vitae (CV) and a tailored Cover Letter highlighting your relevant experience against the key selection criteria outlined above.

To proceed with your application, click the Apply on Employer Site button to access the official CyberCX careers gateway.