Lead Detection Engineer (SIEM, SOAR and Automation)
where TimeGenerated > ago(24h)
summarize LastSeen = max(TimeGenerated) by Computer
where LastSeen < ago(1h)
If you've ever run something like this and found a log source had quietly stopped talking, you already know why telemetry health matters.
This team needs someone who never wants to find out the hard way.
A large Australian organisation is looking for a Lead Detection Engineer to lead detection engineering, security automation and telemetry health across its hybrid SOC.
Reporting to the SOC Manager, you'll be the senior hands‐on technical voice driving the move to an automated, agentic SOC.
What you'll be doing
Leading detection engineering, rule tuning and continuous mapping to MITRE ATT&CK;
Designing, building and refining SOAR workflows and automated incident response playbooks
Monitoring, baselining and auditing log pipelines, so there are no blind spots
Building API integrations and telemetry connectors across the security stack




Turning threat intelligence into proactive hunts, and piloting agentic SOC workflows
Acting as the technical quality lead for the managed provider, validating escalations and driving detection improvements
Leading root cause analysis, threat modelling and post‐incident engineering improvements
What you'll bring
Extensive cyber security experience in a large enterprise environment
Robust hands‐on experience across detection engineering, SOAR, SIEM and EDR
Experience with API integrations, data parsing and log pipeline health
A strong understanding of adversary TTPs and MITRE ATT&CK;
Experience working with managed security providers in a hybrid SOC
Bonus points for Python, API orchestration or agentic security workflows, and certifications such as GCDA, GCTI or GCSA
The practical bits
Permanent, full time
Hybrid, Sydney
#J-*****-Ljbffr

📌 Lead Detection Engineer (Siem, Soar And Automation) (Sydney)
🏢 RONIN Dynamics
📍 Sydney