Security Operations Engineer / Specialist | Security Operations, Detection Engineering & Incident Response
Location:
ACT (Hybrid)
Security Clearance:
NV1 Cleared (Mandatory)
Contract Length:
12 Months + 2 x 12 Month Extensions (Based on the discretion of the Department)
About the Position:
This is a hands-on cyber security role.
The focus is on actively finding, understanding and responding to threats, while continuously improving how they are detected in the first place.
Working across cloud-hosted and enterprise environments, you'll use platforms such as Microsoft Sentinel and Defender to investigate security events, develop and tune detection use cases, conduct threat hunting and support incident response. You'll also work closely with development, DevOps and security teams so operational learnings can feed back into system design and security controls.
The distinction here is important. This isn't primarily a coordination or operational management position. The requirement is for someone who remains technically hands-on across detection engineering, investigation, response and security tooling.
What You'll Do:
Develop and tune security monitoring, analytics rules, dashboards and detection use cases across SIEM/SOAR platforms.
Conduct proactive threat hunting and investigate security events from initial triage through containment, eradication, recovery and root cause analysis.
Build automation playbooks and scripts that improve response times,



while supporting vulnerability management and remediation activities.
Work with DevOps, development and security teams to strengthen detection coverage, security controls and operational resilience.
What We Are Looking For:
Strong hands-on cyber security operations experience across monitoring, threat analysis, investigation and incident response in enterprise or cloud environments.
Practical SIEM/SOAR capability, preferably Microsoft Sentinel, including KQL queries, analytics rules, alert tuning and dashboards.
Experience with security automation and scripting, together with cloud security monitoring and controls, preferably across Microsoft Azure.
Understanding of government cyber security frameworks and practices, including the ISM and Essential Eight.
Technology & Environment:
KQL, SIEM/SOAR & Security Automation
Microsoft Azure, Cloud Security & DevOps
Threat Hunting, Incident Response & Vulnerability Management
A Quick Note Before You Apply:
This role is unlikely to suit candidates whose recent experience has moved primarily into cyber coordination, governance or management without continued hands-on involvement in security operations.
The setting calls for someone comfortable getting into the detail: investigating alerts, querying telemetry, developing detections, hunting for threats and improving the tooling and controls around them.
Applicants must be Australian Citizens and hold a minimum
NV1 Security Clearance
.
#J-*****-Ljbffr

📌 Security Operations Engineer/ Analyst (Canberra)
🏢 Talent
📍 Canberra