About the company
Our client is a major ASX-listed Australian organisation with a large national footprint. Their Cyber Defence function protects a complex, high-volume environment across thousands of endpoints, servers and users.

About the role
This is a hands-on SOC Level 2 role for someone who gets into the weeds. You’ll own escalations, investigate what’s happening at the endpoint and OS level, and drive incidents through to resolution during Melbourne business hours. You’ll work closely with Cyber Defence colleagues in the overseas team, coordinating escalations and handovers to keep coverage seamless across regions. Your responsibilities
- Triage, investigate and respond to alerts and incidents, owning escalations from Level 1
- Lead hands-on incident response: endpoint investigation, containment, remediation and recovery
- Analyse suspicious activity across endpoints, servers, identities and networks
- Coordinate response and handovers with offshore Cyber Defence teams




- Use EDR/XDR, SIEM and monitoring tools to detect and investigate threats
- Contribute to threat hunting, detection tuning and SOC improvement Experience required
- Proven experience as a SOC L2 Analyst, Incident Responder or similar hands-on role
- Robust endpoint security and EDR investigation skills
- Solid Windows, Windows Server, Active Directory and Microsoft troubleshooting (Linux a plus)
- Working knowledge of MITRE ATT&CK; and incident response processes Nice to have
- Palo Alto Cortex XSIAM / XDR (highly regarded), but Defender for Endpoint, Sentinel, CrowdStrike, Splunk or similar are equally relevant
- Endpoint forensics, threat hunting, PowerShell or automation Product experience matters less than strong systems knowledge and genuine incident response capability.

📌 Incident Response (Melbourne)
🏢 Decipher Bureau
📍 Melbourne