Profectus is seeking an experienced Lead Cyber Security Automation Engineer to design and build security automation and detection capability within an Australian Government agency. You will develop automated workflows and playbooks that connect the Cyber Security Operations Centre (CSOC) with SIEM, SOAR, threat intelligence and detection platforms. The work covers alert triage and enrichment, threat intelligence automation, detection engineering and incident response orchestration.

Key Responsibilities

- Identify automation opportunities across detection, monitoring, investigation, threat hunting and incident response
- Develop automated workflows and playbooks that reduce repetitive analyst tasks and improve response times
- Automate alert enrichment, triage, escalation, containment and remediation where appropriate
- Integrate security platforms through REST APIs, webhooks and custom connectors
- Build scripts and tooling using Python, PowerShell and Ansible
- Automate ingestion, normalisation, enrichment and distribution of threat intelligence
- Integrate threat intelligence sources with SIEM, SOAR, TIP, EDR and NDR platforms
- Automate Indicator of Compromise (IOC) lifecycle management, including validation, scoring, expiry and removal
- Build validation, exception handling, logging and monitoring into automated workflows
- Maintain automation code through source control, peer review, testing and controlled CI/CD releases
- Define data requirements for use cases and playbooks in line with the event logging strategy
- Mentor colleagues and share knowledge across a cross-functional agile team

Required Experience





- 5+ years of hands-on experience designing and building cyber security automation playbooks and workflows in a large enterprise or government environment
- Integrating SIEM and SOAR platforms with enterprise security and ICT systems using REST APIs, webhooks, custom connectors and JSON
- Robust scripting and development skills in Python, PowerShell, Ansible or similar
- Practical knowledge of security operations, including incident triage, threat hunting, vulnerability management and incident response
- Working knowledge of the PSPF, ISM, Essential Eight and NIST
- Applying DevSecOps practices, including source control, peer review, automated testing, CI/CD and controlled releases
- Translating security requirements into automated technical solutions and explaining outcomes to technical and non-technical stakeholders
- Integrations across threat intelligence, EDR/NDR, identity and access management, vulnerability management, cloud security, firewalls, ticketing and CMDB platforms
- Automating threat intelligence lifecycle management using STIX and TAXII
- Detection-as-code and detection formats such as Snort, Suricata, Zeek, YAML and JSON
- AI-enabled security operations tooling
- Mentoring and documenting automation work for knowledge transfer within multidisciplinary teams

Security Clearance Requirements

- Must be an Australian Citizen
- Must have an AGSVA NV1 Security Clearance

Working Arrangements

- Onsite for the first six weeks, then hybrid (minimum three days per week onsite)

Why Profectus

Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.

📌 Cyber Security Automation Engineer (Canberra)
🏢 Profectus
📍 Canberra