Overview
Principal Digital Forensic and eDiscovery
The Department of Customer Service is looking for a Principal Digital Forensics and eDiscovery lead to join our growing cyber security team. This is an influential role providing technical advice, support and recommendations on digital investigations, forensics analysis and eDiscovery processes.
Benefits
* Fantastic ongoing grade 11/12 technical leadership role driving the insider risk stream, eDiscovery capabilities, and operational excellence.
* Salary range: $149,739 – $173,174 + super, commensurate with experience.
* Excellent leave entitlements: 20 days annual leave, plus up to an additional 24 days flexible leave.
* Flexible and remote working opportunities from anywhere in NSW.
About you
* Accomplished cyber security professional with over 7 years of experience, specialising in insider risk management, threat detection, and behavioural analytics.
* Proven track record in leading large-scale digital investigations, designing insider risk detection workflows, and executing complex eDiscovery strategies.
* Expert in digital forensics, insider risk platforms, UEBA, and data analysis across diverse operating systems and file types.
* Deep understanding of legal evidence handling, chain of custody, and regulatory compliance frameworks.
* Adept at building and scaling insider threat programs, integrating advanced analytics to enhance detection and response capabilities.
* Strong communicator and collaborator, skilled at bridging technical and non-technical teams to drive security initiatives and investigations.
* Demonstrated ability to influence stakeholders and deliver executive-level insights.
* Experienced in enterprise environments with a focus on resilience, privacy, and ethical risk management.
* Hold industry-recognised certifications.
* Known for analytical rigor, attention to detail, and a commitment to maintaining the integrity and accuracy of sensitive investigations.
Responsibilities
* Lead a team of analysts responsible for triaging insider risk alerts, managing referrals, and conducting digital evidence collection to support investigations and cyber incident response.
* Drive an enterprise-wide Insider Risk Management (IRM) strategy, aligning detection, investigation, and mitigation of insider threats, data loss, and misuse.
* Design and implement scalable frameworks leveraging UEBA, DLP, SIEM, and behavioural analytics to enhance insider risk detection and response capabilities.
* Direct the acquisition, preservation, and analysis of digital evidence across endpoints, servers, mobile devices, and cloud environments ensuring chain of custody, and legal admissibility of evidence where required.
* Collaborate cross-functionally with Legal, HR, Compliance, and IT to ensure alignment with regulatory, legal, and ethical standards.
* Develop and refine policies, procedures, and playbooks to support insider risk investigations and digital evidence handling.
* Provide executive-level reporting on insider risk trends, program maturity, and key performance metrics to inform strategic decision-making.
* Champion a culture of trust, transparency, and accountability while balancing security with privacy.
* Evaluate and integrate emerging technologies and methodologies to continuously improve insider risk posture and investigative capabilities.
* Deliver expert guidance on insider threat detection and digital forensics, ensuring team readiness across diverse technology environments.
* Partner with internal and external stakeholders to resolve technical challenges, deploy advanced security capabilities, and strengthen organisational resilience.
* Document and present investigative findings to legal counsel, senior leadership, and relevant stakeholders with clarity and precision.
Essential Requirements
Australian citizenship with the successful applicant having, or being able to attain and maintain, a baseline security clearance or higher as a condition of employment.
If you want to be part of this forward thinking, innovative team that thrive in challenging the status quo, we would love to hear from you!
What we need from you
To start your journey towards becoming our Principal Digital Forensics and eDiscovery, please click on the link below and attach your resume (max 4 pages) and cover letter (max 2 pages).
In your cover letter please provide an overview of your suitability to the role based on the 'Responsibilities' and 'About you' sections above.
A talent pool may be created from this recruitment process to fill future ongoing and temporary opportunities.
For any enquiries regarding this role, please contact Nicole Turner Talent Acquisition Advisor at nicole.turner@customerservice.nsw.gov.au.
Salary Grade 11/12, with the base salary for this role starting at $149,739 base plus superannuation
Click Here to access the Role Description. For enquiries relating to recruitment please contact Sandy Anderson via sandy.anderson@customerservice.nsw.gov.au.
Visit the Capability Application Tool to prepare for the recruitment process by accessing practice application and interview questions based on the focus capabilities listed in the role description.
Closing Date: Friday 20th February 2026 @10am
Careers at Department of Customer ServiceA career at the Department of Customer Service (DCS) gives you the opportunity to help improve government services and be part of reform that benefits people across NSW. We are focused on delivering excellent customer service, digital transformation, and regulatory reform. Come join us and influence the future of our great state.
Belong in our diverse and inclusive workplaceYou can view our full diversity and inclusion statement here. We want you to bring your best self to this application process. If you have any support or access needs that may require adjustments to allow you to fully participate in this selection process (including an alternate format of the application form) please contact sandy.anderson@customerservice.nsw.gov.au or 02 9494 8351.
For more information, please visitInformation on some of the different types of disabilitiesInformation on adjustments available for the recruitment process
#J-18808-Ljbffr