About the company

Our client is a major ASX-listed Australian organisation with a large national footprint. Their Cyber Defence function protects a complex, high-volume setting across thousands of endpoints, servers and users.

About the role

This is a hands-on SOC Level 2 role for someone who gets into the weeds. You’ll own escalations, investigate what’s happening at the endpoint and OS level, and drive incidents through to resolution during Melbourne business hours.

You’ll work closely with Cyber Defence colleagues in the overseas team, coordinating escalations and handovers to keep coverage seamless across regions.

Your responsibilities
Triage, investigate and respond to alerts and incidents, owning escalations from Level 1
Lead hands-on incident response: endpoint investigation, containment, remediation and recovery
Analyse suspicious activity across endpoints, servers, identities and networks
Coordinate response and handovers with offshore Cyber Defence teams




Use EDR/XDR, SIEM and monitoring tools to detect and investigate threats
Contribute to threat hunting, detection tuning and SOC improvement

Experience required
Proven experience as a SOC L2 Analyst, Incident Responder or similar hands-on role
Robust endpoint security and EDR investigation skills
Solid Windows, Windows Server, Active Directory and Microsoft troubleshooting (Linux a plus)
Working knowledge of MITRE ATT&CK; and incident response processes

Nice to have
Palo Alto Cortex XSIAM / XDR (highly regarded), but Defender for Endpoint, Sentinel, CrowdStrike, Splunk or similar are equally relevant
Endpoint forensics, threat hunting, PowerShell or automation

Product experience matters less than solid systems knowledge and genuine incident response capability.

📌 Incident Response Melbourne
🏢 Decipher Bureau
📍 Melbourne