# Principal Security Operations Center AnalystHuntress
· huntress.comCategory: Detection & ResponseLocation: AustraliaLevel: Staff / Principal## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.
* 12 weeks parental leave
* EquityWhat We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations.

That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all.

That's why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

Reports to: Manager, Security Operations CenterLocation: Remote AustraliaCompensation Range: $180,000 to $215,000 AUD base plus bonus and equity.

What You'll Do

As our Principal SOC Analyst in Australia, you're the most senior technical voice on the APAC SOC floor, working Monday to Friday. You'll take ownership of the hardest intrusions, turn what the floor sees every day into durable detection and product improvements,



and raise the bar for every analyst around you. You'll lead by example as a cultural driver for the team, and you'll help build our Human Led Agentic SOC, where agents handle volume and humans own quality. You'll work closely with Product, Product Research and Detection Engineering Threat Hunting. We'll also support you in publishing your research through Huntress blogs, webinars and conference talks.

Responsibilities:

Own complex, multi-host intrusions end to end, from triage through forensic timelining, root cause and remediation, across endpoint, identity (Microsoft 365 / Google Workspace) and SIEM telemetryAct as the SOC's technical partner to Product, Product Research and DE TH: turn recurring floor pain points into lasting detection, suppression and product fixes rather than workaroundsPerform advanced static and energetic malware analysis, research emerging tradecraft, and publish findings through Huntress contentFind repeatable investigation patterns and toil, then design, build and maintain both automation and human-led agentic workflows with Workflow Engine owners, Product and Engineering, with inline QC/QA built in from the startOwn quality on the floor: grade AI agent and analyst output, trace misses to their root cause and fix them at the source, and act as final technical reviewer on detection tuning,



suppression decisions and high-impact incident reportsProvide technical leadership and mentoring across every level of the team: set investigation standards, run case reviews, ride-alongs and knowledge sessions, advise the Senior Manager on SOC direction, and help assess candidates in the hiring processBe a cultural driver for the team: model Give a $hit, Warrior Spirit and Outcome-Obsessed, keep a low-ego, share-everything team culture, and champion the "agents handle volume, humans own quality" mindsetHandle threat-related escalations from SOC Support, writing clear explanations of complex activity and its business risk for technical and non-technical audiencesWhat You Bring To The Team:6+ years in SOC, Incident Response, DFIR or MDR roles, including leading multi-host intrusion investigationsDeep knowledge of attacker tradecraft across MITRE ATT CK (credential access, lateral movement, persistence, defense evasion, living-off-the-land) and how to detect itDeep forensic and investigation experience across Windows, macOS and LinuxStrong cloud identity investigation and remediation experience in Microsoft 365 / Entra ID and Google WorkspaceAdvanced static and dynamic malware analysis, including extracting IOCs and determining capability and intentStrong enterprise Windows administration (Active Directory, Group Policy, PowerShell, domain trusts) and core networking knowledgeStrong hands-on AI

skills:
daily use of tools such as Claude and Codex for analysis, research and building automation and agentic workflows (Python, PowerShell or similar), with sound judgment about validating their outputUnderstanding of inline quality delivery: building QC/QA into workflows as they run (quality gates, statistical sampling, drift detection and regression testing) rather than relying o

📌 Principal Security Operations Center Analyst (Canberra)
🏢 VulnU
📍 Canberra