Threat Intelligence & Hunting Lead (Critical Infrastructure)

Permanent, full time

Melbourne, hybrid

Up to $187,500 + Super

About the opportunity:

A major critical infrastructure organisation in the energy sector is looking for a Threat Intelligence & Hunting Lead to shape and grow its intel and hunt function. You’ll be the go to person for understanding who is targeting the business and why, and for finding the activity that slips past standard detections. The role covers IT, OT and cloud environments, so it suits someone who wants their work to protect assets that keep the lights on for millions of people.

What you’ll be doing:

- Owning the direction and maturity of the threat intelligence and threat hunting function, keeping it aligned to the wider cyber strategy
- Running intel led hunts across endpoint, network, identity and cloud telemetry to uncover threats that existing controls miss
- Building and refining hunt playbooks, use cases and detection content mapped to MITRE ATT&CK; and current adversary behaviour
- Tracking threat actors, emerging campaigns and vulnerabilities, assessing what they mean for the business and advising on next steps
- Writing transparent intel reports and delivering briefings to everyone from engineers through to executives
- Bringing threat actor context and technical analysis into incident response when things go wrong
- Working closely with the Cyber Defence, Offensive Security,



Network Security and OT Security teams to sharpen detection and test controls
- Growing relationships with intel vendors, industry peers and government partners to strengthen information sharing
- Mentoring others and lifting cyber capability across the wider team

What we need to see:

- 3+ years in cyber threat intelligence, threat hunting or a closely aligned field
- Solid understanding of the intelligence lifecycle and adversary TTPs
- A track record of planning and running hypothesis based hunts, not just responding to alerts
- Hands on experience with MITRE ATT&CK;, the Cyber Kill Chain and the Diamond Model
- Experience across SIEM, EDR/XDR, network detection, identity and cloud security tooling, plus threat intel platforms
- Experience tracking advanced or state sponsored threat actors and building actor profiles
- The ability to analyse malware and indicators of compromise and turn the findings into practical recommendations
- Confidence explaining threats and risk to both technical and non technical audiences

Bonus points:

- Experience in OT, ICS or SCADA environments, or within energy, utilities or other critical infrastructure
- Exposure to SOCI Act obligations
- Involvement with ISACs, ASD/ACSC or other intel sharing communities
- Certifications such as GCTI, GCFA, GCIH, GNFA or CTIA
- Experience standing up or maturing a CTI or hunt capability from the ground up

📌 Threat Intelligence & Hunting Lead (Melbourne)
🏢 CircuIT Recruitment Group
📍 Melbourne