This organisation is running a dedicated cyber resilience program to uplift its security operations, and this role sits at the centre of it.

It operates a large, complex hybrid workplace with a big and diverse user population, critical systems to protect and an external MDR and managed SOC already in place. What it needs now is a senior engineer on the inside who owns the technology and holds those providers to a high standard.

You will have genuine ownership: telemetry, detections, automated response, vulnerability reporting and edge protection all run through you. It's a broad role with real problems to solve, like tuning a WAF to block real attacks while letting through legitimate traffic that looks hostile at first glance.

This is a hands-on engineering role with SME authority, not an advisory or oversight position. It's a 12 month contract engaged through a statement of work.

What the role covers:

- Microsoft Sentinel engineering: ingestion pipelines, Data Collection Rules and log tier optimisation (Analytics, Basic, Auxiliary) to balance retention against cost; advanced KQL analytics and Workbooks
- SOAR automation: building Azure Logic Apps playbooks for behavioural containment, such as offshore logins followed by VPN triggering session revocation or step-up MFA
- Managed SOC and MDR governance: acting as the internal SME on escalations, refining runbooks,



validating detection fidelity and killing false positives
- Vulnerability management: running Tenable and WAS scans, pre-filtering the noise and publishing CVSS, CVE and EPSS reporting to Power BI
- Edge and network security: moving Akamai WAF properties to block mode without breaking legitimate workloads, and enforcing Illumio micro-segmentation around critical systems

What you will bring:

- Deep, hands-on Microsoft Sentinel experience: advanced KQL, DCR configuration, ingestion tier optimisation and custom Workbooks
- SOAR playbooks you have built and deployed in Azure Logic Apps, using REST APIs
- Experience working with or governing an MDR provider or managed SOC, including detection engineering against MITRE ATT&CK;
- Hands-on with Tenable and WAS scanning, Akamai App & API Protector or Illumio; the more of these the better
- Enterprise network and DNS security in hybrid environments, plus scripting in PowerShell or Python (nice to have: SC-200, SC-100, AZ-500 or CISSP)

This would suit a senior security engineer finishing a Sentinel or SOC uplift contract, or someone at an MSSP or MDR provider who wants to move client side and own the outcome.

Sydney based candidates only; background and professional suitability checks required.

For a confidential conversation, contact ••••@decipherbureau.com

📌 Senior Cyber Operations Engineer (Contract) (Sydney)
🏢 The Decipher Bureau
📍 Sydney