About the chance

A leading financial services organisation is looking for an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.

You'll work in a high-performing security team, ideally using Splunk and your knowledge of current attack techniques to detect, investigate and respond to threats across web applications, networks and endpoints.

What you'll do

- Analyse web, application, authentication, endpoint and security appliance logs to identify malicious activity
- Use Splunk (or any other SIEM tool) to investigate security events, and build macros, alerts and dashboards that surface targeted attacks
- Identify common exploits and attack patterns (OWASP Top 10 and beyond) from web and event logs
- Interpret Apache, IIS and Active Directory logs alongside other security data sources
- Detect anomalous or malicious network activity using advanced analytics and security tooling
- Support incident response, recommending and helping implement mitigations, including WAF and CDN security controls




- Interpret stateful firewall rules and contribute to security operations procedures and continuous improvement

About you

Essential

- Strong intrusion analysis background, with proven ability to interpret web and application logs from a security perspective
- Solid understanding of how web applications work under the hood, including HTTP/HTTPS, DNS and TLS
- Knowledge of common web application attack vectors and current exploits, including SQL injection, cross-site scripting and remote file inclusion
- Experience independently investigating issues end-to-end and incident response experience
- Comfortable with scripting languages and regular expressions
- Working knowledge of enterprise client/server architecture
- Intermediate to expert capability, equivalent to L2/L3 in a tiered SOC model
- Experience with Web Application Firewalls (WAF)
- Experience with Akamai or other CDN security controls beneficial

If this sounds like you, and you are a Permanent Resident or an Australian citizen, please apply at the earliest with your resume! You can contact Urvi Thacker for any queries.

📌 Security Detection and Response Analyst (Sydney)
🏢 Morgan Mckinley
📍 Sydney