One of our Federal Government Clients is seeking to engage a Cyber Security Automation Engineer - EL1

Please check below all the job details:

1. Contract Duration: 03 Years (12 Months initially + 24 Months extension)
2. Work Location: Canberra (Hybrid available)
3. Work Arrangement: First 6 weeks work fulltime onsite, thereafter work 3 days from office and 2 days from home each week
4. Eligibility: You must need to have NV1 Security Clearance or above.
5. Tentative Start Date: 1st Feb 2027
6. Working Hours: 8 hours a day/ 40 hours a week

Overview Cyber Security Automation Engineer is responsible for designing, developing, integrating and continuously improving automation and detection capabilities across the organisation’s Cyber Security Operations Centre (CSOC) and broader cyber security functions.

The role provides specialist engineering capability across Cyber Threat Detection, Security Operations, Threat Intelligence, Threat Hunting and Incident Response, with a strong focus on Integrating these functions through automation, orchestration, data enrichment and repeatable engineering practices.

The Cyber Security Automation Engineer will work closely with security analysts, detection engineers, threat intelligence specialists, threat hunters, incident responders, security architects and platform engineering teams to identify opportunities where automation can improve the speed, consistency, accuracy and effectiveness of cyber security operations.

The role will also contribute to the engineering and optimisation of detection capabilities, ensuring that security telemetry, threat intelligence and analytical techniques are translated into actionable detections and automated response workflows.

Key duties and responsibilities:

- Identify high-value opportunities for automation across detection, monitoring, investigation, threat hunting and incident response process.
- Develop automated workflows and playbooks to reduce repetitive analyst activities and improve response times.
- Automate alert enticement, triage, investigation, escalation, containment and remediation process where appropriate.
- Develop reusable automation components, functions,



integrations and security services.
- Integrate security platforms through apis or other suitable integration mechanisms.
- Develop scripts and applications using languages such as Ansible, Python, powershell and other appropriate technologies.
- Implement appropriate validation, exception handling, logging, monitoring and security control with automated workflows.
- Maintain automation code using source control, power review, testing and controlled deployment practices.
- Automate ingestion, normalisation, enrichment and distribution of threat intelligence.
- Integrate external and internal threat intelligence sources with Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Transaction Internet Protocol (TIP), Endpoint Detection and Response (EDR), Network Detection and Response (NDR), and other security platforms.
- Automate Indicator of Compromise (IOC) lifecycle management including validation, enrichment, scoring, expiry and removal.
- Develop mechanisms to measure whether threat intelligence is contributing to meaningful detection and response outcomes.
- Apply software Engineering and devsecops practices including Continuous Integration and Continuous Delivery (CI/CD) pipeline, source control, automated testing, controlled releases etc.
- Determine data requirements to support use cases and playbooks in support of event logging strategy.
- General requirements
- Share knowledge and expertise as the subject matter expert and provide assistance and mentorship to colleagues.
- Work collaboratively as part of a cross-functional agile team to achieve defined project outcomes.
- Act with integrity by promoting workplace practices aligned with the APS Values and the APS Code of Conduct.




- Exercise delegation in accordance with legislation and guidelines.

Knowledge / Qualifications: Cyber security knowledge and experience:

1. Protective Security Policy Framework (PSPF).
2. Information Security Manual (ISM).
3. Essential 8 Strategies.
4. National Institute of Standards and Technology (NIST).

- Incident response lifecycle (such as Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned (PICERL).
- 5+ years of hands-on experience designing and building cyber security automation playbooks, workflows in an enterprise or government setting.
- Experience integrating SIEM/SOAR platforms with enterprise security and IT systems via APIs, webhooks and custom connectors.
- Strong scripting skill in Ansible, Python, PowerShell etc security automation and tool integration.
- Understanding of security operations process including incident triage, threat hunting, vulnerability management and incident response.
- Ability to translate security requirements into automated technical solutions and communicate outcomes to technical and non-technical stakeholders.

Technical Skills (continued):

- Representational State Transfer (REST) Application Programming Interface (APIs).
- JavaScript Object Notation (JSON).
- and related integration technologies.
- CI/CD and DevSecOps.

Technical skills:

- Security Orchestration, Automation, and Response (SOAR) platforms.
- Security Information and Event Management (SIEM) platforms.
- Threat Intelligence platforms.
- Vulnerability Management platforms.
- Identity and Access Management systems.
- Case management and ticketing systems.
- Asset management and Configuration Management Database (CMDB) platforms.
- Firewall and Network Security technologies.

External Threat intelligence and security services:
1. Ansible.
2. Python.
3. PowerShell development.

The Next step is easy: If you are interested, you may send an email to [email protected] Referral incentive program: As always, we have the candidate referral incentive program through which you will get $1000 for each successful referral after the successful selection and joining of the referred candidates

📌 Cyber Security Automation Engineer (Australian Capital Territory)
🏢 IT Alliance Australia
📍 Australian Capital Territory