{"id":193475,"url":"https://alion.io/job/triskele-labs-digital-forensics-analyst","title":"Digital Forensics Analyst","company":{"id":60634,"name":"Triskele Labs","domain":"triskelelabs.com","url":"https://alion.io/company/triskele-labs","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Melbourne, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Carbon Black","optional":false},{"name":"Crowdstrike","optional":false},{"name":"KAPE","optional":false},{"name":"Linux","optional":false},{"name":"Magnet AXIOM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Velociraptor","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"X-Ways Forensics","optional":false}],"status":"live","first_seen_at":"2026-09-02T00:00:00Z","employer_posted_date":"2026-09-02","last_verified_at":"2026-10-22T02:48:49Z","board_verified":true,"closed_at":null,"days_open":50,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":50},"description":"Triskele Labs is an Australian cyber security firm delivering Managed Detection and Response, Governance Risk and Compliance, Penetration Testing, and Digital Forensics and Incident Response. We hold CREST Cyber Security Incident Response (CSIR) accreditation.\nThe Digital Forensics Team\nWe investigate cyber incidents for clients across Australia, remotely and on site. We establish how an intrusion occurred, what the Threat Actor did, and whether data was accessed or taken. Every matter is backed by a written report that stands up to review by the client, their insurer and their legal counsel.\nWork arrives from two directions. Reactive matters are referred by cyber insurers, brokers and legal panel firms, and move at pace. Proactive work is delivered to retainer clients, covering forensic readiness and response planning.\nWe investigate ransomware and data extortion, business email compromise, insider threat, unauthorised access, data theft, funds redirection, website and endpoint compromise, and internal investigations.\nYou will work alongside a highly technical and seasoned group of digital forensics practitioners. Everyone carries live matters. Digital Forensics sits alongside Incident Response within the wider DFIR practice.\nRequirements\nExperience and Skills\nMinimum one year of experience in a digital forensics role.\nUnderstanding of the incident lifecycle.\nSound understanding of Windows and Linux forensic artefacts.\nExposure to Microsoft 365 investigation is advantageous.\nExperience acquiring and handling evidence in a forensically sound manner, including chain of custody.\nFamiliarity with Threat Actor tactics, techniques and procedures.\nBusiness-fluent written English.\nEligibility to work in Australia.\nTools\nExperience with the following tools is relevant to the role:\nForensic suites such as Magnet Axiom, X-Ways Forensics, and Intella are advantageous.\nExperience with acquisition, triage, and analysis tools such as KAPE, EZ Tools, Hayabusa, Velociraptor, Chainsaw, and Volatility.\nExperience investigating Microsoft 365 and Entra ID environments, including the Unified Audit Log, sign-in and audit logs, mailbox rules, delegate access, and OAuth application grants, is advantageous.\nExperience with EDR and SIEM tools such as SentinelOne, CrowdStrike, Microsoft Defender, Carbon Black, Microsoft Sentinel, Elastic, and Rapid7 is advantageous.\nTraining and Certifications\nSANS and GIAC certifications are a significant bonus, in particular GCFE, GCFA, GCFR and GCIH. Vendor training in Magnet Axiom, X-Ways or Intella is also valued.\nTwo courses are mandatory for every member of the team: 13Cubed Investigating Windows Endpoints and 13Cubed Investigating Linux Endpoints. If you do not hold these, Triskele Labs will fund and enrol you.\nHours, On-Call and Overtime\nParticipation in the on-call rotation is voluntary.\nYou will work out of hours as matters require, particularly in the opening days of a ransomware or major incident matter. Out of hours work is paid as overtime.\nBenefits\nJoin a supportive and driven team where each team member is valued.\nCollaborative and growth-oriented culture with opportunities for career development.\nHybrid working environment, with some in-office presence expected\nSalary packaging, novated leasing available\nAccess to Triskele Labs Discounts and Benefits Platform\nOngoing training opportunities\nWhy Triskele Labs?\nTriskele Labs is a place where passion for cybersecurity and client success thrive. Our commitment to \"Deliver Awesome\" drives us to exceed expectations, making a tangible difference in our clients’ security journey.\nApplication Process\nApplications without a cover letter will be immediately disqualified. Address your cover letter to Richard Grainger, Global Head of Digital Forensics. Tell us about why you are ideal for this role.","description_format":"text","description_chars":3829,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"Australia","iso":"AU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Cybersecurity","Managed Security"],"lifecycle":[{"event":"open","at":"2026-09-03T02:21:33Z"}],"visa":[],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.426,"p_room":0.45,"age_days":49,"expected_fill_days":27,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/triskele-labs-digital-forensics-analyst","json_url":"https://alion.io/job/triskele-labs-digital-forensics-analyst.json","meta":{"generated_at":"2026-10-22T02:54:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2457,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":60634},"rest":"https://alion.io/mcp/rest/get_company?id=60634"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftriskele-labs-digital-forensics-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftriskele-labs-digital-forensics-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftriskele-labs-digital-forensics-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/triskele-labs-digital-forensics-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftriskele-labs-digital-forensics-analyst"}]}