Lead Detection Engineer (SIEM, SOAR and Automation)

Heartbeat

where TimeGenerated > ago(24h)

summarize LastSeen = max(TimeGenerated) by Computer

where LastSeen < ago(1h)

If you’ve ever run something like this and found a log source had quietly stopped talking, you already know why telemetry health matters. This team needs someone who never wants to find out the hard way.

A large Australian organisation is looking for a Lead Detection Engineer to lead detection engineering, security automation and telemetry health across its hybrid SOC. Reporting to the SOC Manager, you’ll be the senior hands-on technical voice driving the move to an automated, agentic SOC.

What you’ll be doing
Leading detection engineering, rule tuning and continuous mapping to MITRE ATT&CK;
Designing, building and refining SOAR workflows and automated incident response playbooks
Monitoring, baselining and auditing log pipelines, so there are no blind spots
Building API integrations and telemetry connectors across the security stack




Turning threat intelligence into proactive hunts, and piloting agentic SOC workflows
Acting as the technical quality lead for the managed provider, validating escalations and driving detection improvements
Leading root cause analysis, threat modelling and post-incident engineering improvements

What you’ll bring
Extensive cyber security experience in a large enterprise setting
Robust hands-on experience across detection engineering, SOAR, SIEM and EDR
Experience with API integrations, data parsing and log pipeline health
A robust understanding of adversary TTPs and MITRE ATT&CK;
Experience working with managed security providers in a hybrid SOC
Bonus points for Python, API orchestration or agentic security workflows, and certifications such as GCDA, GCTI or GCSA

The practical bits
Permanent, full time
Hybrid, Sydney

Got a detection or automation you’re quietly proud of? I’d love to hear about it.

📌 Lead Detection Engineer Siem, Soar And Automation Sydney
🏢 RONIN Dynamics
📍 Sydney