Digital Forensics Incident Response Manager

About Triskele Labs

At Triskele Labs, we deliver high-impact incident response services when clients need us most. In FY25 alone, we completed 201 incident response engagements, with a strong mix of ransomware and business email compromise cases. As demand grows, we are expanding our DFIR team with a new Incident Response Manager role focused on client coordination, internal direction, and calm leadership under pressure.

The Role

This is not a hands-on forensics role. Instead, you’ll be leading incidents from the front, keeping clients informed, managing our internal DFIR team’s momentum, and acting as the voice of reason in moments of crisis. You’ll need to be technical enough to interpret complex scenarios and communicate them clearly to clients, law firms, insurers, and internal stakeholders.

Requirements

In this role, you’ll be at the forefront of managing cyber incidents for a diverse client base, ensuring clear communication, effective coordination, and seamless delivery of incident response services. You’ll work closely with clients, insurers, legal teams, and technical experts to keep investigations on track and provide timely, actionable updates. This position requires a balance of technical fluency and strong stakeholder management skills, making it ideal for someone who thrives in high-pressure environments and is passionate about supporting organisations through critical cyber events.

Key Responsibilities

• Manage end-to-end coordination of cyber incidents across a wide range of clients
• Act as the main point of contact for clients, insurers, and incident response law firms
• Translate technical findings into clear, actionable updates for both technical and non-technical stakeholders
• Keep DFIR investigations on track by setting direction, managing timelines, and clarifying objectives
• Build and deliver update decks and talking points for incident status update calls
• Participate in paid after-hours and weekend incident response rotation
• Assist with planning, preparation, and follow-up for tabletop exercises and readiness reviews

What We’re Looking For

• 1 or more years in incident response, cybersecurity, or technical coordination roles
• Strong understanding of ransomware, BEC, threat actor behaviour, and common IR workflows
• Excellent communication and stakeholder management skills
• Comfortable leading client-facing calls and briefings in high-pressure situations
• Technically fluent, you understand the language of IR and can translate it clearly, but you're not expected to conduct hands-on forensics
• Experience working with legal teams, insurers, and executive stakeholders
• Based in Australia or New Zealand with full working rights

Benefits

Why Join Us

• Work alongside one of the most experienced DFIR teams in the region
• Join a company that completed over 200 incident responses last financial year
• Flexible conditions and paid on-call support
• Engage directly with major clients, insurers, and cyber law firms
• Be part of a growing, respected team where your leadership makes a real difference

How to Apply

Submit your application including a cover letter addressed to Craig Martin, Global Head of Incident Response (this is mandatory and applications without a cover letter or not addressed to the right person will be immediately disqualified), or reach out directly for a confidential chat.

We’re always ready to speak with strong communicators who thrive in high-stakes environments.