About the Role
DroneShield is seeking a Detection and Response Engineer with relevant experience to join the Security team in Sydney, NSW. The Security team is responsible for protecting DroneShield's assets and users. Our adversaries are sophisticated and use state-of-the-art tooling. The role focuses on detection strategy, response strategy, and influencing corporate security and vulnerability management.
Key Responsibilities
Own and improve our existing detection strategy, including tooling, custom detections, process, threat intelligence, etc.
Develop, tune, and maintain detection rules across SIEM and security tooling; improve signal‐to‐noise ratio by reducing false positives and enhancing alert fidelity.
Leverage threat intelligence, vulnerability data, and attacker techniques to build new detections.
Investigate and respond to security incidents across endpoints, cloud, and SaaS environments; support incident handling from detection through containment, eradication, and recovery.
Participate in incident response rotations and follow established runbooks.
Assist in coordinating cross‐team response efforts during incidents.
Contribute to automation of detection and response workflows (scripts, playbooks) and work with security orchestration tools.
Work with security orchestration tools to improve response efficiency and support development and improvement of internal security tools.
Conduct post‐incident reviews (RCA) and contribute lessons learned.
Identify gaps in detection and response capabilities and propose improvements; maintain and improve incident response documentation and runbooks.
Work closely with engineering, IT,



and security teams on investigations and improvements; communicate findings and incident updates clearly to stakeholders.
Contribute to building a strong security culture across the organization.
Qualifications and Experience
3‐6 years of experience in security operations, incident response, or detection engineering.
Hands‐on experience investigating security incidents in cloud or enterprise environments.
Familiarity with SIEM platforms and log analysis.
Basic scripting or programming experience (Python, Bash, KQL, Go, or PowerShell).
Understanding of common attack techniques, malware behaviour, and threat lifecycle.
Experience with Linux/macOS command line environments.
Knowledge of cloud platforms (AWS, Azure, or similar).
Strong analytical and problem‐solving skills.
Nice to Have
Experience with detection‐as‐code or infrastructure‐as‐code.
Exposure to malware analysis or digital forensics.
Experience with automation frameworks or SOAR platforms.
Understanding of threat modelling and attacker methodologies.
Familiarity with up-to-date security tools (EDR, IDS, cloud security tools).
Interest in leveraging AI/LLMs for security operations.
What Success Looks Like
Effectively triage and respond to security alerts with minimal supervision.
Contribute meaningful improvements to detection coverage and response speed.
Build automation that reduces manual workload.
Demonstrate growth toward owning incident response and detection strategy.
Why This Role
Hands‐on exposure to real‐world security incidents.
Opportunity to grow into a senior D&R; or security engineering role.
Work in a fast‐paced, high‐impact security environment.
Contribute to protecting critical systems and users.
#J-*****-Ljbffr

📌 Detection And Response Engineer (Au) (New South Wales)
🏢 Droneshield
📍 New South Wales