Prefer working the case over building the tooling? This is a hands-on analyst role in a global cloud security operations team. You’ll own incidents yourself, dig through the logs, and explain what happened to the people who need to know.

What’s on offer

- Up to $170K + super
- 4-day week, three days off. Choose Wed to Sat or Sun to Wed (9:00am to 7:30pm) and keep that roster
- In the office for the first 6 months, then one weekday from home each week
- A cloud security operations team spread across Australia, Singapore, the US and Europe
- A Sydney CBD office alongside around 40 people in the Sydney cyber team
- A easy interview process: one 1-hour technical panel, ideally in person

The team and the work

The cloud security operations team identifies, investigates and responds to threats across the bank’s Azure, AWS, GCP and SaaS environments. You’ll report to a hiring manager in Singapore and work with 4 analysts there and 4 in Sydney.

The environment is Azure heavy, so if you’ve worked incidents in AWS, you’ll bring something the team is short on.
Day to day, you’ll:

- Investigate alerts and incidents from triage through to closure, running them yourself
- Work cases ranging from brute-force attempts and suspicious AI use to data exfiltration and CVE exploitation
- Pull and analyse logs in Splunk and Azure Log Analytics across all three clouds and SaaS
- Spot unfamiliar data mid-incident and work out whether it matters
- Tune existing detections and build new ones
- Keep documentation current as the environment and tooling change
- Explain findings clearly to technical and non-technical audiences, with colleagues in the US,



Europe and APAC

What you’ll bring
Must-have:

- 2 to 7 years as an analyst in a SOC or security operations role. This is an analyst role, not engineering
- Hands-on incident response in at least one of Azure, AWS or GCP
- Experience working incidents end to end without supervision
- Log analysis in a SIEM such as Splunk or Elastic
- Broad awareness of security operations and enterprise IT
- The ability to explain technical findings to non-technical people

Desirable:

- Incident response across two or more of Azure, AWS and GCP, plus SaaS (AWS and Azure together is ideal)
- Alert tuning in a cloud environment
- Scripting or programming experience
- A large enterprise or banking background
- Certifications such as SC-200, AZ-900, AWS Certified Cloud Practitioner, AWS Certified Security – Specialty, CompTIA Cloud+ or CCSK
- A degree in Computer Science, Computer Engineering, Information Security or Digital Forensics

About Decipher Bureau
Decipher Bureau is Australia’s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don’t just match skills to a job description. We take the time to understand both the technical requirements of a role and the team environment, so every introduction we make is a considered one.

Interested?
If this sounds like your next move, click Apply or reach out for a confidential chat. There’s more detail on the team and environment that can be shared one on one.

Kris Rosentreter, 0452 564 ***
****@decipherbureau.com

📌 Senior Cloud Security Analyst (SOC & Incident Response) x 2 (Sydney)
🏢 The Decipher Bureau
📍 Sydney