Senior Adviser – Digital Forensics & Incident Response

Location: Flexible
Employment type: Full-time, permanent
Security clearance: Baseline required; NV1 preferred
On-call: Incident response roster, including after-hours and weekends

About Island Bell

Island Bell Advisers is a multi-disciplinary strategic advisory firm for organisations facing their most complex challenges. Cyber security is our core discipline, alongside strategic advisory, resilience and reputation, and government and regulatory work. Our advisers include a former government agencies’ heads, senior intelligence and law enforcement officers, and industry experts who have led cyber security functions, crisis communications and major incident responses for some of the largest organisations in Australia and overseas

About the role

As Senior Adviser, DFIR, you will be a senior technical lead when clients face serious cyber incidents. You will take ownership of the response from initial triage through investigation, containment and recovery, translating complex forensic findings into clear, defensible advice for executives, boards, legal counsel, insurers and regulators.

Your work will extend beyond incident response. You will help clients prepare before incidents occur, test their readiness, identify existing compromises and turn lessons learned into practical improvements.

Working alongside Island Bell's crisis communications, government and strategic advisers, you will help deliver an integrated response across the technical, legal, regulatory and reputational dimensions of a cyber incident.

This is a hands-on leadership role for someone who can investigate deeply, lead confidently and communicate clearly under pressure.

What you'll do

Lead major cyber incident responses

• Lead end-to-end responses to ransomware, data theft and extortion, business email compromise, insider threats and cloud compromise.

• Direct triage, scoping, containment, eradication and recovery, coordinating client teams and specialist providers.

• Brief executives and boards on emerging facts, risks, options and decisions.

• Lead engagements under legal privilege where appropriately instructed through external counsel.

Deliver rigorous digital forensics

• Investigate endpoints, servers, memory, networks, logs, cloud environments and SaaS platforms.

• Establish attacker activity, root cause, incident timelines and the extent of data access or exfiltration.

• Maintain defensible evidence handling and chain of custody.

• Produce clear forensic reports and support expert statements or evidence where required.

Support regulatory and stakeholder engagement

• Help clients navigate applicable Australian cyber incident reporting and data breach notification obligations.

• Work with legal counsel, cyber insurers, breach coaches, regulators, law enforcement and the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), as appropriate.

• Coordinate technical findings with Island Bell's crisis communications and government advisers to support consistent, well-informed decisions.

Build preparedness and resilience

• Develop and test incident response plans, playbooks and escalation frameworks.

• Deliver technical and executive tabletop exercises and crisis simulations.

• Conduct compromise assessments and threat hunts.

• Lead post-incident reviews and recommend prioritised, costed improvements.

Build the practice

• Contribute to client proposals, engagement scoping, pricing and incident response retainers.

• Develop repeatable methods, tools, templates and evidence handling procedures.

• Mentor advisers and analysts, share expertise and contribute to client briefings and thought leadership.

About you

You are an experienced DFIR practitioner who combines technical depth with the judgement and composure to lead when the pressure is on. You are comfortable working with incomplete information, challenging assumptions and explaining complex findings to people who need to make consequential decisions.

You bring:

• At least 10 years' experience in cyber security, including five or more years of hands-on digital forensics and incident response.

• A demonstrated record of leading complex incident responses from initial triage through to recovery and reporting.

• Strong forensic capability across Windows, Linux and macOS, including memory, log and network analysis.

• Experience investigating cloud and identity environments, particularly Microsoft 365 and Entra ID, plus at least one major cloud platform.

• Practical experience with industry-standard forensic, endpoint detection and response, and SIEM tools. Relevant tools may include CrowdStrike, Microsoft Defender, SentinelOne, Velociraptor, KAPE, Volatility, Magnet AXIOM, X-Ways, KQL and SPL.

• Working knowledge of Australian regulatory reporting obligations and defensible evidence handling.

• The ability to produce clear, robust forensic reports and brief senior stakeholders in high-pressure situations.

• Strong professional judgement, discretion and personal accountability.

Highly regarded

You will be particularly well suited if you also bring:

• Consulting experience or experience delivering incident response retainers across multiple sectors, including financial services, critical infrastructure, health or government.

• Experience working with external counsel under legal privilege and alongside cyber insurers or breach coaches.

• Malware analysis or reverse engineering capability.

• Experience preparing expert statements or giving evidence.

• A background in law enforcement, defence or intelligence.

A tertiary qualification in cyber security, computer science, digital forensics or a related discipline, or equivalent practical experience, is expected. Certifications such as GCFA, GCFE, GNFA, GCIH, GREM or relevant CREST incident response certifications are valued.

The practical requirements

• Security clearance: An Australian Government Baseline Security Clearance is required. NV1 is preferred. You must be an Australian citizen and willing and eligible to obtain and maintain the required clearance.

• On-call: Participation in the incident response roster, including after-hours and weekend response.

• Travel: Interstate and occasional international travel at short notice when incidents require.

• Confidentiality: The ability to handle highly sensitive client information in accordance with legal, regulatory and professional obligations.

Make a difference when it matters most.

If you are a senior DFIR practitioner ready to take the lead on complex incidents, advise at the highest levels and help build a distinctive cyber security advisory practice, we would like to hear from you.

Apply now to join Island Bell Advisers.