Principal DFIR Analyst

Work anywhere in New Zealand Permanent, full time role. Health New Zealand | Te Whatu Ora is the country's largest employer, delivering universal public healthcare to 5 million New Zealanders. We provide essential hospital, specialist, and community health services across 80+ locations - from large urban centres to rural towns and remote communities. Our goal is to improve health outcomes for all New Zealanders by delivering equitable, accessible and innovative care. About the Role As the Principal Digital Forensics and Incident Response (DFIR) Analyst, you will play a critical leadership role in protecting Health New Zealand from sophisticated cyber threats and major security incidents. As the senior technical expert and escalation point for the National Security Operations Centre (NSOC), you will lead complex digital forensic investigations, incident response, threat hunting, and cloud security operations across enterprise environments. Working alongside cyber security, IT, clinical, and executive stakeholders, you will shape the national DFIR strategy, strengthen detection and response capabilities, and mentor the next generation of cyber security professionals. You'll also leverage modern AI-driven security technologies, threat intelligence platforms, automation, and advanced analytics to enhance threat detection, accelerate incident response, and improve the organisation's overall cyber resilience—helping ensure the security of critical healthcare systems and the continuity of patient care across New Zealand. About the Team/Service/ Location You'll join Health New Zealand's National Cyber Security team, working within the National Security Operations Centre (NSOC) to protect one of the country's largest and most complex digital environments. The team is responsible for monitoring, detecting, investigating, and responding to cyber threats that impact national healthcare services, ensuring the confidentiality, integrity, and availability of systems that support clinicians, patients, and healthcare workers across Aotearoa. Working alongside highly skilled cyber security professionals, architects, engineers, and technology partners, you'll contribute to a collaborative, innovative, and continuously evolving environment that embraces modern security practices, automation, AI-driven technologies, and continuous learning. This is a national role with the flexibility to be based from one of Health New Zealand's locations or work in a hybrid arrangement, while making a meaningful impact on the security and resilience of New Zealand's healthcare system. About you You're an experienced cyber security professional with a passion for protecting critical infrastructure and responding to complex cyber threats. You thrive in high-pressure environments and have a proven ability to lead major cyber incidents from initial detection through to recovery, combining deep technical expertise with sound judgement and strategic thinking. As a recognised subject matter expert in digital forensics, incident response, and threat detection, you're comfortable making critical decisions, guiding technical investigations, and influencing cyber security strategy at an enterprise or national level. You are a collaborative and people-focused leader who enjoys mentoring others, sharing knowledge, and building capability across technical teams. You communicate complex technical concepts clearly to both technical and non-technical audiences and build trusted relationships with stakeholders across cyber security, technology, clinical services, executive leadership, and external partners. With a commitment to continuous learning, innovation, and operational excellence, you're passionate about leveraging emerging technologies—including AI, automation, and advanced analytics to strengthen cyber resilience while supporting Health New Zealand's commitment to Te Tiriti o Waitangi and equitable health outcomes for all New Zealanders. To succeed in this role, you will bring: Postgraduate qualification in Cyber Security (or equivalent) and recognised industry certifications such as SANS (GCIH, GMON, GCED), BTLO, CompTIA Security+, CySA+, or equivalent. 10+ years' experience in Cyber Security and Security Operations, with extensive expertise leading responses to major cyber incidents including ransomware, data breaches, and advanced persistent threats. Advanced expertise in Digital Forensics, Incident Response (DFIR), Threat Hunting, Threat Intelligence, Malware Analysis, and the end-to-end incident response lifecycle. Strong technical proficiency with enterprise security technologies including SIEM, SOAR, EDR/XDR, Microsoft Sentinel, Microsoft Defender, Microsoft 365 Security, Entra ID, cloud security, and digital forensics tools. Proven leadership experience mentoring and developing high-performing cyber security teams while driving operational excellence and continuous capability uplift. Exceptional communication and stakeholder management skills, with the ability to present complex technical information and influence decision-making at executive and technical levels. Demonstrated experience designing and implementing cyber security strategies, detection capabilities, incident response frameworks, automation, and AI-driven security solutions to strengthen organisational resilience. A collaborative, innovative, and values-driven approach, with a commitment to Te Tiriti o Waitangi, equitable health outcomes, continuous improvement, and protecting NewZealand's critical healthcare infrastructure. Working for Health New Zealand Health New Zealand | Te Whatu Ora is dedicated to ensuring excellent healthcare for the people of NewZealand. We embrace a workforce that is diverse and inclusive so that we are better positioned to understand and service our community. We welcome applications from our diverse Māori, Pacific, disabled, and rainbow communities. #J-18808-Ljbffr