Are you looking for your next state goverenmnt role?

Your new company
A leading Victorian State Government agency is seeking an experienced Cyber Incident Response Analyst to join its Information Security Services Branch, safeguarding one of the state's largest technology environments. You'll join a collaborative, forward-thinking team driving security uplift and operational resilience.

Your new role

- Lead end-to-end detection, triage, containment and recovery of cyber incidents in line with the department's Cyber Security Incident Response Plan (CSIRP).
- Conduct Level 2/3 investigations and threat hunting using Microsoft Sentinel, Splunk, Defender and EDR tools.
- Perform daily SOC monitoring, alert triage and escalation, correlating threat intelligence across platforms to identify emerging threats.
- Build and enhance Sentinel detection engineering, including analytics rules, MITRE ATT&CK; mapping, workbooks, playbooks and automation, and improve SOC processes.
- Deliver situation reports, post-incident reviews, RCA reports, security metrics and executive briefings.
- Provide expert advice on Microsoft Sentinel, Defender, Google Security, Tenable and ServiceNow.
- Partner with ICT and school technical teams, service providers and Victorian Government cyber agencies to strengthen security posture.

What you'll need to succeed

- Proven experience leading cyber incident response, including CSIRT, crisis management, containment, recovery and post-incident review.
- Strong SOC background across monitoring, alert investigation, threat intelligence,



threat hunting and SIEM/EDR platforms.
- Deep expertise in Microsoft Sentinel and Defender, including advanced KQL.
- Hands-on detection engineering: log management, analytics rule tuning, workbooks, playbooks, automation and use cases.
- Sound knowledge of NIST CSF, MITRE ATT&CK;, ASD Essential Eight and incident response frameworks.
- Vulnerability and risk management experience, with the ability to advise technical and non-technical stakeholders.
- Excellent communication and report-writing skills (RCA reports, incident summaries, executive briefings), with confidence engaging senior executives.
- Strong analytical and problem-solving skills, with the ability to prioritise complex incidents under pressure.
- Tertiary qualifications in Cyber Security, IT or a related field, plus industry-recognised certifications.

What you'll get in return

- Lead a strategic, high-visibility government initiative.
- Hybrid working and a supportive, collaborative culture.
- Competitive daily rate with extension potential.

What you need to do now
If you're interested in this role, click 'apply now' to forward an up-to-date copy of your CV, or call us now.
If this job isn't quite right for you, but you are looking for a current position, please contact us for a confidential discussion on your career.

Hays appreciates the importance of workforce diversity and inclusion. We are an equal-opportunities employer and have policies, procedures and relationships in place to promote our understanding of all forms of diversity.#3025802

📌 Cyber Incident Response Lead (CBD)
🏢 Hays
📍 CBD