Lead Detection Engineer (SIEM, SOAR and Automation) Heartbeat | where TimeGenerated > ago(24h) | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(1h) If you’ve ever run something like this and found a log source had quietly stopped talking, you already know why telemetry health matters. This team needs someone who never wants to find out the hard way. A large Australian organisation is looking for a Lead Detection Engineer to lead detection engineering, security automation and telemetry health across its hybrid SOC. Reporting to the SOC Manager, you’ll be the senior hands-on technical voice driving the move to an automated, agentic SOC. What you’ll be doing
• Leading detection engineering, rule tuning and continuous mapping to MITRE ATT&CK;
• Designing, building and refining SOAR workflows and automated incident response playbooks
• Monitoring, baselining and auditing log pipelines, so there are no blind spots
• Building API integrations and telemetry connectors across the security stack
• Turning threat intelligence into proactive hunts,



and piloting agentic SOC workflows
• Acting as the technical quality lead for the managed provider, validating escalations and driving detection improvements
• Leading root cause analysis, threat modelling and post-incident engineering improvements What you’ll bring
• Extensive cyber security experience in a large enterprise workplace
• Robust hands-on experience across detection engineering, SOAR, SIEM and EDR
• Experience with API integrations, data parsing and log pipeline health
• A robust understanding of adversary TTPs and MITRE ATT&CK;
• Experience working with managed security providers in a hybrid SOC
• Bonus points for Python, API orchestration or agentic security workflows, and certifications such as GCDA, GCTI or GCSA The practical bits
• Permanent, full time
• Hybrid, Sydney Got a detection or automation you’re quietly proud of? I’d love to hear about it.

📌 Lead Detection Engineer Sydney
🏢 RONIN Dynamics
📍 Sydney