Investigate real international attacks across AWS, Azure, GCP and SaaS for a global bank, from the first alert through to closure.

- Permanent | Sydney CBD | Up to $170K + super | Hybrid after first 6 Months
- Two permanent seats at AVP level, one suited to someone ready to lead others.
- 4-day week: 9:00am to 7:30pm, Wed to Sat OR Sun to Wed | 1 Day a week WFH

Prefer working the case over building the tooling? This is a hands-on analyst role in a global cloud security operations team. You’ll own incidents yourself, dig through the logs, and explain what happened to the people who need to know.

What’s on offer

- Up to $170K + super
- 4-day week, three days off. Choose Wed to Sat or Sun to Wed (9:00am to 7:30pm) and keep that roster
- In the office for the first 6 months, then one weekday from home each week
- A cloud security operations team spread across Australia, Singapore, the US and Europe
- A Sydney CBD office alongside around 40 people in the Sydney cyber team
- A simple interview process: one 1-hour technical panel, ideally in person

The team and the work The cloud security operations team identifies, investigates and responds to threats across the bank’s Azure, AWS, GCP and SaaS environments. You’ll report to a hiring manager in Singapore and work with 4 analysts there and 4 in Sydney.

The workplace is Azure heavy, so if you’ve worked incidents in AWS, you’ll bring something the team is short on.

Day to day, you’ll:

- Investigate alerts and incidents from triage through to closure, running them yourself
- Work cases ranging from brute-force attempts and suspicious AI use to data exfiltration and CVE exploitation
- Pull and analyse logs in Splunk and Azure Log Analytics across all three clouds and SaaS
- Spot unfamiliar data mid-incident and work out whether it matters




- Tune existing detections and build new ones
- Keep documentation current as the environment and tooling change
- Explain findings clearly to technical and non-technical audiences, with colleagues in the US, Europe and APAC

What you’ll bring

Must-have:

- 2 to 7 years as an analyst in a SOC or security operations role. This is an analyst role, not engineering
- Hands-on incident response in at least one of Azure, AWS or GCP
- Experience working incidents end to end without supervision
- Log analysis in a SIEM such as Splunk or Elastic
- Broad awareness of security operations and enterprise IT
- The ability to explain technical findings to non-technical people

Desirable

- Incident response across two or more of Azure, AWS and GCP, plus SaaS (AWS and Azure together is ideal)
- Alert tuning in a cloud environment
- Scripting or programming experience
- A large enterprise or banking background
- Certifications such as SC-200, AZ-900, AWS Certified Cloud Practitioner, AWS Certified Security – Specialty, CompTIA Cloud+ or CCSK
- A degree in Computer Science, Computer Engineering, Information Security or Digital Forensics

About Decipher Bureau

Decipher Bureau is Australia’s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don’t just match skills to a . We take the time to understand both the technical requirements of a role and the team environment, so every introduction we make is a considered one.

Interested?

If this sounds like your next move, click Apply or reach out for a confidential chat. There’s more detail on the team and environment that can be shared one on one.

Kris Rosentreter, 0452 564 644

[email protected]

📌 Senior Cloud Security Analyst (SOC & Incident Response) x 2 (Sydney)
🏢 Decipher Bureau
📍 Sydney