About the Role

Our client is one of Australia's largest private operators in critical infrastructure, based in North Sydney. They're growing out their internal security function and looking for a Cyber Security Engineer to build and own their Microsoft Sentinel and Defender detection capability.

This is an engineering role, not a SOC or triage position. The organisation runs a managed SOC for alert monitoring and response, so this role sits above that, writing and tuning detection logic, developing analytical rules, and improving platform coverage across Sentinel and Defender.

What You'll Do
Design, build and tune Microsoft Sentinel analytics rules and Defender custom detections
Write and maintain KQL queries for threat hunting, log coverage analysis and detection logic
Improve platform coverage and reduce false positives across the Microsoft security stack
Work closely with the managed SOC provider, owning the detection logic they operate against
Translate purple team and red team findings into recent or tuned detections




Communicate detection and risk findings to internal technical stakeholders

What We're Looking For
Hands-on experience building and tuning Sentinel analytics rules and/or Defender detections, not just responding to alerts
Solid working knowledge of KQL
Solid understanding of Windows log sources and how security telemetry actually reaches a SIEM
Comfortable working directly with a managed SOC provider rather than running triage yourself
Australian citizens or permanent residents only. We are unable to offer visa sponsorship for this role
Based in Sydney and able to work onsite three days a week

What's on Offer
$160,000 base + superannuation + 20% performance-linked STIP
Hybrid working, three days a week onsite in North Sydney
The chance to build detection capability from the ground up at a genuine critical infrastructure operator

📌 Cyber Security Engineer Detection Engineering Microsoft Sentinel North Sydney
🏢 Pathway Search
📍 North Sydney