Manager - Digital Forensics and Incident Response

One purpose, one practice

We are public purpose sector specialists who support governments and their agencies, and not-for-profit organisations, to deliver services to Australians, helping to build more resilient, equitable, secure and prosperous communities. We are guided by our values of Stronger Together, Amplify Impact, Build Trusted Relationships, Value Every Person, Think Beyond Limits, and Defined by Ethics.

Our purpose-driven professionals provide clients with access to the skills, capabilities and expertise to support the delivery of government agendas and public purpose projects, with specialist teams across three national practices:

• Transformation

• Risk, Programs and Cyber

• Commercial, Financial and Infrastructure

The Team

Our  Cyber  capability is a leader in trust-based services to the public and for-purpose sector, we are here to support clients whenever a concern or big decision arises. We support clients to achieve outcomes for communities that are increasingly seeking trusted sources of information around issues like organisational integrity, cyber risk, integrity of data, commitment to sustainability and climate change, as well as the efficiency and effectiveness of transformation programs.

Through our national security operations program, we apply our 'Plan | Practice | Perform' model to help our clients build the capability and confidence needed to successfully prepare for, respond to, and recover from a variety of cyber threats. This includes the provision of full-service 24/7 DFIR and Security Operations support to our clients, in both remote and on-site settings.

As a Manager - Digital Forensics and Incident Response ,   you will create value by:

• Leveraging your technical DFIR skills to help our clients respond to a variety of cyber incidents, providing clients with both hands-on support and expert advice.

• Following recognised DFIR frameworks, methodology and practices, including applicable NIST frameworks, ISO/IEC 27035 and MITRE ATT&CK.

• Working within highly sensitive and regulated environments, across a variety of government and public purpose sectors, adhering to relevant policies and procedures.

• Supporting the growth and professional development of more junior team members, as they expand their DFIR skills and experience.

• Working collaboratively with peers and teams across Scyne and our alliance partners, to ensure we engage all necessary capabilities to support clients' needs.

• Supporting the development of new capabilities, products and services based on market demand.

About you

Aligned to our values, you're collaborative in nature and love working in and celebrating as a team. You respect and care for your colleagues and are curious about others’ views and reflect on the impact we have on others.

You have a growth mindset. You're interested in asking questions to challenge our thinking and love new ideas and trying new things. You're curious about and able to put yourself in the clients’ shoes; you earn and value the trust placed in us.

You're someone who does what you say you'll do, and you do the right thing when no-one is looking, and you call it when you feel something isn’t quite right.

Technically, you will bring to the position:

• 5+ years of proven industry experience working in incident response, digital forensics or security operations.

• A ‘hands-on’ set of technical skills in contemporary technologies including networks, hyperscale clouds (Azure, AWS, GCP), common SaaS applications, end user compute, and data management tools.

• A sound base of knowledge on digital forensics and data analysis practices, as well as hands-on experience and capability with the tooling used to support these activities.

• A sound foundation in relevant industry frameworks such as MITRE ATT&CK and NIST SP 800-61.

• Basic project management skills and the proven ability to lead a team of people in the delivery of a small project.

• Qualifications and certifications in recognised and relevant industry accreditations such as GCIH, GCFA, Security+, CIH, or other related security operations certifications.

• The ability to participate in a 24/7 on-call roster to support after-hours engagements and client response activities - including occassional after-hours office or client site attendance.

Please note:  The position requires you to have an Australian Citizenship and be willing to undertake Baseline (or preferably NV1) clearance to support work with Defence. For more information, please go to  agsva.gov.au ↗