Postgraduate Diploma in Incident Response and Industrial Forensics
Online 800 h Postgraduate Diploma in Incident Response and Industrial Forensics. 8 modules covering NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and Wireshark. Assigned tutor and open enrolment.
Postgraduate Diploma in Incident Response and Industrial Forensics — studying from Australia
Robotics and automation are important to Australian industries, especially mining, agriculture, logistics and manufacturing. Autonomous haulage, robotic harvesting and warehouse automation illustrate the breadth of applications. Research bodies such as CSIRO and universities maintain strong robotics programmes, supporting industry collaboration. Engineers work on control systems, sensing, motion planning and industrial integration. Employers include mining technology companies, agricultural technology firms, automation integrators and research organisations.
Fees for Australia: A$1,740 (AUD), with instalments and employer sponsorship available.
Relevant bodies in Australia
Typical roles
Questions from Australia
Will this qualification be recognised by Engineers Australia for robotics and control roles?
SEIUM qualifications are private and not accredited by Engineers Australia or any national body. Engineers Australia assesses engineering competence through its own processes, and recognition of SEIUM training is decided by employers or the body you apply to. Confirm their requirements before enrolling if professional membership matters to you.
Which Australian employers hire people with robotics and automation skills?
Mining, manufacturing, logistics, agricultural technology, and defence companies across Australia employ automation and control engineers. Whether they value a private qualification depends on each employer's policy. Your project work, programming and practical skills are usually central to hiring decisions.
Can I study this part time while working in Australia, and are there payment options?
Yes, the programmes are 100% online, taught in English, and include an assigned technical tutor, so you can study from anywhere in Australia around work hours. Fees are payable in instalments, and employer sponsorship is possible. Confirm the programme length, which ranges from 300 to 1,900 hours, and plan accordingly.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Plan safe recovery and process validation.
Extract lessons learned and improve the management system.
Who it's for
- OT incident response analyst looking to specialise in Incident Response and Industrial Forensics.
- Industrial digital forensic expert looking to specialise in Incident Response and Industrial Forensics.
- Industrial SOC analyst looking to specialise in Incident Response and Industrial Forensics.
- Plant continuity manager looking to specialise in Incident Response and Industrial Forensics.
- OT cybersecurity consultant looking to specialise in Incident Response and Industrial Forensics.
- Crisis management coordinator looking to specialise in Incident Response and Industrial Forensics.
- Graduates in engineering or science seeking to enter the energy sector.
What you'll work with
- NIST SP 800-61 Rev. 3
- ISO/IEC 27035-1:2023
- ISO/IEC 27037:2012
- IEC 62443-2-1
- NIST SP 800-82 Rev. 3
- Directiva (UE) 2022/2555 NIS2
- ISO/IEC 27043:2015
- NIST SP 800-86
8 modules · 800 h
1.1OT incident taxonomy1.2Reference cases in energy and industry1.3MITRE ATT&CK for ICS framework1.4Two-stage industrial kill chain1.5Impact on safety, the environment and production1.6Threat actors and motivations1.7Differences from IT response1.8NIS2 notification obligations1.9Coordination with INCIBE-CERT and sectoral CSIRTs1.10Practical case: reconstructing a public incident with ATT&CK for ICS
2.1NIST SP 800-61 response lifecycle2.2OT-specific response plan2.3Team roles and escalation2.4Integration with plant emergency plans2.5Playbooks by incident type2.6Response kits and tools2.7Backups of logic and configuration2.8Internal and external communication2.9Tabletop exercises and drills2.10Workshop: ransomware playbook for a supervisory network
3.1Detection sources in the plant3.2Industrial IDS alerts3.3Process anomaly indicators3.4Triage and severity classification3.5Distinguishing a technical fault from an attack3.6Initial containment without stopping the process3.7Safe shutdown decision3.8Recording actions from the outset3.9Chain of custody from the start3.10Practice: alert triage in a simulated industrial SOC
4.1Principles of ISO/IEC 270374.2Volatility and order of acquisition4.3Memory acquisition on engineering workstations4.4Disk images of SCADA servers4.5Capture of industrial network traffic4.6Extraction of PLC logic and firmware4.7HMI and historian logs4.8Risks of altering devices in operation4.9Documentation and integrity hashes4.10Laboratory: acquiring evidence from an engineering workstation
5.1Analysis of Modbus, S7comm and DNP3 traffic5.2Comparison of PLC logic with baseline5.3Timeline of events5.4Analysis of Windows artefacts on HMI5.5ICS-oriented malware analysis5.6Correlation of process and security logs5.7Open-source forensic tools5.8Attribution and its limits5.9Forensic report and technical language5.10Practice: analysis of a capture containing malicious PLC writes
6.1Zone-based containment strategies6.2Restoration of verified logic and configuration6.3Rebuilding compromised workstations6.4Functional safety validation after an incident6.5Staged process restart6.6Enhanced post-incident monitoring6.7Vendor management during recovery6.8Costs and impact of the incident6.9Insurance and contractual aspects6.10Practical case: recovery plan for a water treatment plant
7.1Structured post-incident review7.2Root cause analysis7.3Updating CSMS controls7.4Response indicators: MTTD and MTTR7.5Sharing threat intelligence7.6Legal aspects and data protection7.7Ethics of the forensic analyst7.8Preparing executive reports7.9Planning new exercises7.10Workshop: lessons-learned report after a drill
8.1Incident scenario and scope8.2Response plan tailored to the plant8.3Main playbooks8.4Evidence acquisition procedure8.5Forensic analysis of the scenario8.6Recovery and validation plan8.7Technical and executive report8.8Critical evaluation of the response8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which allows it to be combined with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Volatility, Autopsy, Velociraptor, Zeek, in free, academic or evaluation versions. Practicals are based on real procedures: simulated response to ransomware on an OT network, forensic acquisition from an engineering workstation, and analysis of captured industrial traffic that has been altered. Assessment is continuous by module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient command of Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The work is done with Wireshark, Volatility, Autopsy, Velociraptor and Zeek. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the advanced programme. Check the recognition policy when you enrol.
Related programmes
Diploma in Vibrations/Thermal and Health Index
Online postgraduate diploma of 800 hours in vibration/thermal monitoring and Health Index. 8 modules covering ISO 17359:2018, ISO 20816-1 and ISO 18434-1, with Python (SciPy and…
Postgraduate Diploma in HIL/SIL Orchestration and Virtual Bench
800-hour online Postgraduate Diploma in HIL/SIL Orchestration and Virtual Bench. 8 modules with ASAM XIL 2.2, ASAM OpenSCENARIO and dSPACE SCALEXIO with AutomationDesk. Assigned tutor and…
Postgraduate Diploma in Integration with Drives/IO-Link and Safety PLC
800-hour online Postgraduate Diploma in Integration with Drives/IO-Link and Safety PLC. 8 modules covering ISO 13849-1, ISO 13849-2 and Siemens TIA Portal with Safety Advanced. Assigned…
More in Robotics, Automation & Control
All Robotics, Automation & Control programmes → · How to apply · Fees & financing · Scholarships