{"id":4216252,"url":"https://alion.io/job/defend-senior-dfir-specialist","title":"Senior DFIR Specialist","company":{"id":50129,"name":"DEFEND","domain":"defend.co.nz","url":"https://alion.io/company/defend","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Wellington, New Zealand","Auckland, New Zealand"],"countries":["NZ"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Eric Zimmerman Tools","optional":true},{"name":"KAPE","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Velociraptor","optional":true}],"status":"live","first_seen_at":"2026-11-13T02:51:32Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T02:51:32Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"At DEFEND, our dream is to improve everyday life by creating a cyber resilient world. We’re looking for an Senior DFIR Specialist to support organisations through their most critical cyber moments. You will investigate major incident response engagements, proactively hunt for threats that evade existing controls, and conduct compromise assessments that surface hidden intrusion before it escalates. This role is both a frontline specialist during active incidents and a recognised subject matter expert for customers and DEFEND colleagues alike. You will be trusted to lead complex investigations end to end, drive recovery with clarity and precision, and strengthen cyber resilience in the face of evolving threats.\nIn this role you'll...\nLead the technical side of investigations during major incidents, working alongside the Incident Lead from initial triage through containment and secure recovery.\nGet hands-on with forensic analysis across endpoints, cloud and identity, owning evidence collection and timeline reconstruction to a defensible standard.\nHunt for what others have missed, using threat intelligence and adversary behaviour to scope compromise, uncover threats that have bypassed existing controls, and deliver compromise assessments that show customers their real exposure.\nRecommend containment and eradication actions, and turn technical findings into clear advice that gives technical and non-technical teams the confidence to make decisions under pressure.\nKeep clear, accurate documentation throughout every engagement, and contribute to the post-incident reviews and improvements that follow.\nHelp build a stronger response capability by mentoring and quality-checking the work of analysts, supporting tabletop exercises, and improving the playbooks and processes we use across incident response and threat hunting.\nRequirements\nHands-on incident response experience across complex customer environments.\nStrong digital forensics skills across Windows, Linux and Microsoft 365, with a solid understanding of collecting and handling evidence to a defensible standard.\nExperience with malware analysis as part of an investigation.\nProficiency with SIEM and EDR tools.\nStrong threat hunting skills: forming and testing hypotheses, reading adversary behaviour, and using threat intelligence to anticipate how attackers operate.\nWorking knowledge of incident response frameworks such as NIST and SANS, and sound judgement to apply them under time pressure while an incident is live.\nThe ability to identify control gaps exposed by an incident and translate them into practical recommendations.\nExcellent written and verbal communication, with the confidence to produce clear reports and act as a steady point of advice for technical and business stakeholders.\nExperience mentoring less experienced responders, and a genuine commitment to sharing knowledge and continuous improvement.\nThe ability to manage competing priorities and live incidents while keeping work accurate, thorough and on time.\nDue to the nature of the work & privileged access to customer environments full working rights in New Zealand are required\nNice to have, but not essential\nExperience with the Microsoft security stack, including Sentinel, Defender XDR and Entra ID, and writing KQL queries to investigate and hunt.\nWorking knowledge of PowerShell or Python to automate collection and analysis.\nFamiliarity with DFIR tooling such as KAPE, Velociraptor or Eric Zimmerman’s tools.\nRelevant DFIR certifications.\nBenefits\nAbout DEFEND:\nOur dream at DEFEND is to improve everyday life by creating a cyber resilient world. Over the last few years, we've experienced phenomenal growth and winning several industry awards, including Microsoft's Global Partner of the Year for 2025!\nWhy DEFEND?\nWe believe in investing in our employees’ growth and providing them with opportunities to advance their skills and careers. We offer a collaborative workplace culture, and we are committed to fostering an inclusive environment where innovative thinking is encouraged.\nBy joining our innovative and creative team you will have the opportunity to contribute a variety of cybersecurity outcomes, from culture & awareness of cyber resilience, through to offensive & defensive security. No matter what your role, everyone at DEFEND contributes towards our dream of creating a cyber resilient world.\nThe benefits of working at DEFEND\nIn addition to working for a growing, dynamic NZ company, DEFEND offers the following benefits to all our DEFENDers\n3.5% Kiwisaver on top of your base salary \nSouthern Cross Health Insurance coverage \nMobile and Broadband discounts for yourself and family \nFlexible, hybrid work environment \nAn allowance to contribute to your home office setup \nAccess to EAP services to support you across a range of wellbeing needs \nDiversity & Inclusion:\nAt DEFEND, we celebrate a variety of perspectives and experiences. We know from experience that people from underrepresented groups often don’t apply for roles they don’t feel they meet all the criteria for. We’re committed to creating an environment that enables all our team to thrive. If you think you have what it takes, but don’t check every single box, please consider applying. We’d love to hear how you might contribute to the team and being our next DEFENDer.\nReady to help build a more cyber resilient future with DEFEND?Apply now or learn more at: https://defend.co.nz/careers/","description_format":"text","description_chars":5444,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance","Home office","Hybrid work","Insurance coverage"],"hiring_locations":[{"name":"New Zealand","iso":"NZ","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response"],"lifecycle":[{"event":"open","at":"2026-11-13T02:51:32Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":26,"reasons":["conf:2","win:early"],"computed_at":"2026-11-13T04:55:51Z"},"pay":null,"html_url":"https://alion.io/job/defend-senior-dfir-specialist","json_url":"https://alion.io/job/defend-senior-dfir-specialist.json","meta":{"generated_at":"2026-11-13T04:55:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10429,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50129},"rest":"https://alion.io/mcp/rest/get_company?id=50129"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdefend-senior-dfir-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdefend-senior-dfir-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdefend-senior-dfir-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/defend-senior-dfir-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdefend-senior-dfir-specialist"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4216252}},{"tool":"search_jobs","arguments":{"company":"defend.co.nz","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4216252},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}