Senior Cyber Operations Engineer (Contract) This organisation is running a dedicated cyber resilience program to uplift its security operations, and this role sits at the centre of it.

It operates a large, complex hybrid environment with a big and diverse user population, critical systems to protect and an external MDR and managed SOC already in place. What it needs now is a senior engineer on the inside who owns the technology and holds those providers to a high standard.

You will have genuine ownership: telemetry, detections, automated response, vulnerability reporting and edge protection all run through you. It's a broad role with real problems to solve, like tuning a WAF to block real attacks while letting through legitimate traffic that looks hostile at first glance.

This is a hands-on engineering role with SME authority, not an advisory or oversight position. It's a 12 month contract engaged through a statement of work.

What the role covers:

Microsoft Sentinel engineering: ingestion pipelines, Data Collection Rules and log tier optimisation (Analytics, Basic, Auxiliary) to balance retention against cost; advanced KQL analytics and Workbooks

SOAR automation: building Azure Logic Apps playbooks for behavioural containment, such as offshore logins followed by VPN triggering session revocation or step-up MFA

Managed SOC and MDR governance: acting as the internal SME on escalations, refining runbooks, validating detection fidelity and killing false positives

Vulnerability management: running Tenable and WAS scans, pre-filtering the noise and publishing CVSS, CVE and EPSS reporting to Power BI

Edge and network security: moving Akamai WAF properties to block mode without breaking legitimate workloads,



and enforcing Illumio micro-segmentation around critical systems

This organisation is running a dedicated cyber resilience program to uplift its security operations, and this role sits at the centre of it.

It operates a large, complex hybrid environment with a big and diverse user population, critical systems to protect and an external MDR and managed SOC already in place. What it needs now is a senior engineer on the inside who owns the technology and holds those providers to a high standard.

You will have genuine ownership: telemetry, detections, automated response, vulnerability reporting and edge protection all run through you. It's a broad role with real problems to solve, like tuning a WAF to block real attacks while letting through legitimate traffic that looks hostile at first glance.

This is a hands-on engineering role with SME authority, not an advisory or oversight position. It's a 12 month contract engaged through a statement of work.

What the role covers:

Microsoft Sentinel engineering: ingestion pipelines, Data Collection Rules and log tier optimisation (Analytics, Basic, Auxiliary) to balance retention against cost; advanced KQL analytics and Workbooks

SOAR automation: building Azure Logic Apps playbooks for behavioural containment,



such as offshore logins followed by VPN triggering session revocation or step-up MFA

Managed SOC and MDR governance: acting as the internal SME on escalations, refining runbooks, validating detection fidelity and killing false positives

Vulnerability management: running Tenable and WAS scans, pre-filtering the noise and publishing CVSS, CVE and EPSS reporting to Power BI

Edge and network security: moving Akamai WAF properties to block mode without breaking legitimate workloads, and enforcing Illumio micro-segmentation around critical systems

What you will bring:

Deep, hands-on Microsoft Sentinel experience: advanced KQL, DCR configuration, ingestion tier optimisation and custom Workbooks

SOAR playbooks you have built and deployed in Azure Logic Apps, using REST APIs

Experience working with or governing an MDR provider or managed SOC, including detection engineering against MITRE ATT&CK;

Hands-on with Tenable and WAS scanning, Akamai App & API Protector or Illumio; the more of these the better

Enterprise network and DNS security in hybrid environments, plus scripting in PowerShell or Python (nice to have: SC-200, SC-100, AZ-500 or CISSP)

This would suit a senior security engineer finishing a Sentinel or SOC uplift contract, or someone at an MSSP or MDR provider who wants to move client side and own the outcome.

Sydney based candidates only; background and qualified suitability checks required.

For a confidential conversation, contact **@decipherbureau.com

Additional information

Own Microsoft Sentinel and SOAR engineering

Up to $1100 per day - daily rates

Oversee technical direction of managed services

📌 Senior Cyber Operations Engineer (Sydney)
🏢 Decipher Bureau
📍 Sydney