Senior DFIR Specialist

At DEFEND, our dream is to improve everyday life by creating a cyber resilient world. We’re looking for an Senior DFIR Specialist to support organisations through their most critical cyber moments. You will investigate major incident response engagements, proactively hunt for threats that evade existing controls, and conduct compromise assessments that surface hidden intrusion before it escalates. This role is both a frontline specialist during active incidents and a recognised subject matter expert for customers and DEFEND colleagues alike. You will be trusted to lead complex investigations end to end, drive recovery with clarity and precision, and strengthen cyber resilience in the face of evolving threats.

In this role you'll...

• Lead the technical side of investigations during major incidents, working alongside the Incident Lead from initial triage through containment and secure recovery.
• Get hands-on with forensic analysis across endpoints, cloud and identity, owning evidence collection and timeline reconstruction to a defensible standard.
• Hunt for what others have missed, using threat intelligence and adversary behaviour to scope compromise, uncover threats that have bypassed existing controls, and deliver compromise assessments that show customers their real exposure.
• Recommend containment and eradication actions, and turn technical findings into clear advice that gives technical and non-technical teams the confidence to make decisions under pressure.
• Keep clear, accurate documentation throughout every engagement, and contribute to the post-incident reviews and improvements that follow.
• Help build a stronger response capability by mentoring and quality-checking the work of analysts, supporting tabletop exercises, and improving the playbooks and processes we use across incident response and threat hunting.

Requirements

• Hands-on incident response experience across complex customer environments.
• Strong digital forensics skills across Windows, Linux and Microsoft 365, with a solid understanding of collecting and handling evidence to a defensible standard.
• Experience with malware analysis as part of an investigation.
• Proficiency with SIEM and EDR tools.
• Strong threat hunting skills: forming and testing hypotheses, reading adversary behaviour, and using threat intelligence to anticipate how attackers operate.
• Working knowledge of incident response frameworks such as NIST and SANS, and sound judgement to apply them under time pressure while an incident is live.
• The ability to identify control gaps exposed by an incident and translate them into practical recommendations.
• Excellent written and verbal communication, with the confidence to produce clear reports and act as a steady point of advice for technical and business stakeholders.
• Experience mentoring less experienced responders, and a genuine commitment to sharing knowledge and continuous improvement.
• The ability to manage competing priorities and live incidents while keeping work accurate, thorough and on time.

Due to the nature of the work & privileged access to customer environments full working rights in New Zealand are required

Nice to have, but not essential

• Experience with the Microsoft security stack, including Sentinel, Defender XDR and Entra ID, and writing KQL queries to investigate and hunt.
• Working knowledge of PowerShell or Python to automate collection and analysis.
• Familiarity with DFIR tooling such as KAPE, Velociraptor or Eric Zimmerman’s tools.
• Relevant DFIR certifications.

Benefits

About DEFEND:

Our dream at DEFEND is to improve everyday life by creating a cyber resilient world. Over the last few years, we've experienced phenomenal growth and winning several industry awards, including Microsoft's Global Partner of the Year for 2025!

Why DEFEND?

We believe in investing in our employees’ growth and providing them with opportunities to advance their skills and careers. We offer a collaborative workplace culture, and we are committed to fostering an inclusive environment where innovative thinking is encouraged.

By joining our innovative and creative team you will have the opportunity to contribute a variety of cybersecurity outcomes, from culture & awareness of cyber resilience, through to offensive & defensive security. No matter what your role, everyone at DEFEND contributes towards our dream of creating a cyber resilient world.

The benefits of working at DEFEND

In addition to working for a growing, dynamic NZ company, DEFEND offers the following benefits to all our DEFENDers

• 3.5% Kiwisaver on top of your base salary

• Southern Cross Health Insurance coverage

• Mobile and Broadband discounts for yourself and family

• Flexible, hybrid work environment

• An allowance to contribute to your home office setup

• Access to EAP services to support you across a range of wellbeing needs

Diversity & Inclusion:

At DEFEND, we celebrate a variety of perspectives and experiences. We know from experience that people from underrepresented groups often don’t apply for roles they don’t feel they meet all the criteria for. We’re committed to creating an environment that enables all our team to thrive. If you think you have what it takes, but don’t check every single box, please consider applying. We’d love to hear how you might contribute to the team and being our next DEFENDer.

Ready to help build a more cyber resilient future with DEFEND?Apply now or learn more at: https://defend.co.nz/careers/