Cyber Security Engineer – Detection & Incident Response
You've developed strong security operations experience, but you're ready to do more than investigate alerts and respond to incidents.
You want to improve how threats are detected, take ownership of meaningful improvements and see the impact of your work.
Our client, a national not-for-profit healthcare organisation, is looking for a Cyber Security Engineer – Detection & Incident Response to strengthen its cyber defence capability.
The opportunity
You'll join an established security environment with existing technologies, incident-response practices and an outsourced SOC.
The focus is on improving detection coverage, alert quality, threat intelligence and the processes supporting incident response.
Reporting to the Director of Cyber Defence and Engineering, you'll work closely with experienced cyber leaders who will provide technical guidance while giving you ownership of practical improvements.
With approximately 60% of the role focused on detection and 40% on incident response, this is an opportunity to improve an established capability rather than simply operate it.
By 30 June ****, the priorities are to:
Improve detection:
Strengthen monitoring coverage, develop and tune detection rules, and make better use of threat intelligence to identify suspicious activity.
Strengthen response readiness:
Improve investigation and escalation workflows, support incident response and contribute to phishing simulations and tabletop exercises.
Embed sustainable practices:
Establish documented playbooks, procedures and reporting that the security team can maintain beyond your engagement.
What you'll be doing




Your responsibilities will include:
Assessing monitoring coverage, alert quality and existing response workflows to identify improvement priorities.
Developing and tuning detection rules and investigation logic to improve threat visibility and reduce false positives.
Investigating security alerts, analysing telemetry and supporting the escalation of potential threats.
Integrating relevant threat intelligence into detection rules, investigations and practical threat-hunting activities.
Improving incident-response playbooks, investigation procedures, escalation pathways and evidence handling.
Working with infrastructure, cloud, identity and other technology teams to coordinate authorised containment and remediation activities.
Supporting phishing simulations, tabletop exercises and post-incident reviews.
Developing practical reporting, documenting improvements and transferring knowledge to the wider team.
You'll work with technologies including CrowdStrike, Mimecast and Airlock, alongside other security monitoring and investigation tools.
What you'll bring
We're looking for a hands-on security professional with practical experience in detection, security operations or incident response who is ready to take greater ownership.
You'll ideally bring:
Experience investigating security alerts,



analysing logs and identifying suspicious activity.
Practical exposure to SIEM, EDR/XDR or comparable security monitoring technologies.
An understanding of detection rules, alert tuning, threat intelligence and incident-response processes.
Experience supporting security investigations, incident containment or remediation coordination.
The ability to collaborate with technical teams, communicate findings and improve existing ways of working.
Familiarity with MITRE ATT&CK;, CrowdStrike, Microsoft Defender, Sentinel, KQL or scripting would be advantageous, but experience with every technology isn't essential.
Healthcare experience is not required.
What matters most is your ability to demonstrate practical delivery, solve problems and follow through on agreed outcomes.
Contract details and next steps
This is a full-time fixed-term appointment ending 30 June ****, offering remuneration equivalent to approximately $154,000 base salary plus 12% superannuation annualised. Total remuneration will be pro-rated according to the actual contract period.
Eligible employees may also access not-for-profit salary packaging advantages, providing potential additional tax savings.
This is initially an eight-month fixed-term appointment, with genuine potential to become permanent, subject to future organisational requirements and approvals.
The role offers hybrid working, with a minimum of two days per week onsite. Sydney or ACT is preferred, although other East Coast locations may be considered.
All applications and enquiries will be treated confidentially.
#J-*****-Ljbffr

📌 Cyber Security Engineer – Detection & Incident Response (Sydney)
🏢 Xceltium
📍 Sydney