Postgraduate Diploma in Incident Response and Industrial Forensics
Online 800 h Postgraduate Diploma in Incident Response and Industrial Forensics. 8 modules covering NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and Wireshark. Assigned tutor and open enrolment.
Postgraduate Diploma in Incident Response and Industrial Forensics — studying from New Zealand
Robotics and automation are increasingly important in New Zealand, especially in dairy processing, food manufacturing, forestry, horticulture and logistics. Research groups at the University of Auckland and the University of Canterbury lead in robotics and control engineering, and firms in these regions develop automated systems for primary industries. Engineers work on process control, industrial automation and robotic integration for manufacturers and technology providers.
Fees for New Zealand: NZ$2,160 (New Zealand dollar), with instalments and employer sponsorship available.
Relevant bodies in New Zealand
Typical roles
Questions from New Zealand
Which New Zealand bodies recognise robotics and control engineering?
Engineering New Zealand is the professional body, and the Chartered Professional Engineer pathway is the recognised route to professional status. Universities such as the University of Auckland and the University of Canterbury offer accredited engineering degrees. SEIUM's qualifications are private and not accredited by any national body, so their recognition rests with employers or the relevant body.
Do robotics and automation employers in New Zealand value this training?
New Zealand has demand for automation skills in dairy processing, food manufacturing, forestry, and advanced manufacturing. Employers generally value practical project experience and programming ability highly. A SEIUM qualification can strengthen a CV, but whether it counts is for each employer to decide.
Is the programme workable alongside a full-time job in New Zealand?
Yes. The programme is 100% online and taught in English, so you can study from anywhere in New Zealand without a student visa. Master's programmes total 1,900 hours, postgraduate diplomas 800 hours and specialist courses 300 hours. You have an assigned technical tutor, and fees are payable in instalments or sponsored by an employer where possible.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Plan safe recovery and process validation.
Extract lessons learned and improve the management system.
Who it's for
- OT incident response analyst looking to specialise in Incident Response and Industrial Forensics.
- Industrial digital forensic expert looking to specialise in Incident Response and Industrial Forensics.
- Industrial SOC analyst looking to specialise in Incident Response and Industrial Forensics.
- Plant continuity manager looking to specialise in Incident Response and Industrial Forensics.
- OT cybersecurity consultant looking to specialise in Incident Response and Industrial Forensics.
- Crisis management coordinator looking to specialise in Incident Response and Industrial Forensics.
- Graduates in engineering or science seeking to enter the energy sector.
What you'll work with
- NIST SP 800-61 Rev. 3
- ISO/IEC 27035-1:2023
- ISO/IEC 27037:2012
- IEC 62443-2-1
- NIST SP 800-82 Rev. 3
- Directiva (UE) 2022/2555 NIS2
- ISO/IEC 27043:2015
- NIST SP 800-86
8 modules · 800 h
1.1OT incident taxonomy1.2Reference cases in energy and industry1.3MITRE ATT&CK for ICS framework1.4Two-stage industrial kill chain1.5Impact on safety, the environment and production1.6Threat actors and motivations1.7Differences from IT response1.8NIS2 notification obligations1.9Coordination with INCIBE-CERT and sectoral CSIRTs1.10Practical case: reconstructing a public incident with ATT&CK for ICS
2.1NIST SP 800-61 response lifecycle2.2OT-specific response plan2.3Team roles and escalation2.4Integration with plant emergency plans2.5Playbooks by incident type2.6Response kits and tools2.7Backups of logic and configuration2.8Internal and external communication2.9Tabletop exercises and drills2.10Workshop: ransomware playbook for a supervisory network
3.1Detection sources in the plant3.2Industrial IDS alerts3.3Process anomaly indicators3.4Triage and severity classification3.5Distinguishing a technical fault from an attack3.6Initial containment without stopping the process3.7Safe shutdown decision3.8Recording actions from the outset3.9Chain of custody from the start3.10Practice: alert triage in a simulated industrial SOC
4.1Principles of ISO/IEC 270374.2Volatility and order of acquisition4.3Memory acquisition on engineering workstations4.4Disk images of SCADA servers4.5Capture of industrial network traffic4.6Extraction of PLC logic and firmware4.7HMI and historian logs4.8Risks of altering devices in operation4.9Documentation and integrity hashes4.10Laboratory: acquiring evidence from an engineering workstation
5.1Analysis of Modbus, S7comm and DNP3 traffic5.2Comparison of PLC logic with baseline5.3Timeline of events5.4Analysis of Windows artefacts on HMI5.5ICS-oriented malware analysis5.6Correlation of process and security logs5.7Open-source forensic tools5.8Attribution and its limits5.9Forensic report and technical language5.10Practice: analysis of a capture containing malicious PLC writes
6.1Zone-based containment strategies6.2Restoration of verified logic and configuration6.3Rebuilding compromised workstations6.4Functional safety validation after an incident6.5Staged process restart6.6Enhanced post-incident monitoring6.7Vendor management during recovery6.8Costs and impact of the incident6.9Insurance and contractual aspects6.10Practical case: recovery plan for a water treatment plant
7.1Structured post-incident review7.2Root cause analysis7.3Updating CSMS controls7.4Response indicators: MTTD and MTTR7.5Sharing threat intelligence7.6Legal aspects and data protection7.7Ethics of the forensic analyst7.8Preparing executive reports7.9Planning new exercises7.10Workshop: lessons-learned report after a drill
8.1Incident scenario and scope8.2Response plan tailored to the plant8.3Main playbooks8.4Evidence acquisition procedure8.5Forensic analysis of the scenario8.6Recovery and validation plan8.7Technical and executive report8.8Critical evaluation of the response8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which allows it to be combined with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Wireshark, Volatility, Autopsy, Velociraptor, Zeek, in free, academic or evaluation versions. Practicals are based on real procedures: simulated response to ransomware on an OT network, forensic acquisition from an engineering workstation, and analysis of captured industrial traffic that has been altered. Assessment is continuous by module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Characterise cybersecurity incidents in industrial environments using ATT&CK for ICS.
Develop response plans and playbooks tailored to the plant.
Carry out alert triage, prioritising process safety.
Acquire digital evidence while preserving its integrity and chain of custody.
Analyse traffic, PLC logic and artefacts from industrial systems.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient command of Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The work is done with Wireshark, Volatility, Autopsy, Velociraptor and Zeek. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the advanced programme. Check the recognition policy when you enrol.
Related programmes
Postgraduate Diploma in Food/Pharma Applications and Hygienic Certification
Online 800-hour Postgraduate Diploma in Food/Pharma Applications and Hygienic Certification. 8 modules covering EN 1672-2, ISO 14159 and Siemens TIA Portal. Dedicated tutor and open enrolment.
Postgraduate Diploma in HA/DRP Architectures and Cybersecurity
Online 800 h Postgraduate Diploma in HA/DRP Architectures and Cybersecurity. 8 modules covering IEC 62443-2-1, IEC 62443-3-2 and Wireshark. Assigned tutor and open enrolment.
Diploma in Process Parameters and Cord Control
Online postgraduate diploma of 800 hours in process parameters and weld bead control: 8 modules covering automated welding processes, process parameters, specification and qualification, bead geometry…
More in Robotics, Automation & Control
All Robotics, Automation & Control programmes → · How to apply · Fees & financing · Scholarships