Profectus is seeking an experienced Lead Cyber Security Automation Engineer to design and build security automation and detection capability within an Australian Government agency.
You will develop automated workflows and playbooks that connect the Cyber Security Operations Centre (CSOC) with SIEM, SOAR, threat intelligence and detection platforms.
The work covers alert triage and enrichment, threat intelligence automation, detection engineering and incident response orchestration.
Key Responsibilities
Identify automation opportunities across detection, monitoring, investigation, threat hunting and incident response
Develop automated workflows and playbooks that reduce repetitive analyst tasks and improve response times
Automate alert enrichment, triage, escalation, containment and remediation where appropriate
Integrate security platforms through REST APIs, webhooks and custom connectors
Build scripts and tooling using Python, PowerShell and Ansible
Automate ingestion, normalisation, enrichment and distribution of threat intelligence
Integrate threat intelligence sources with SIEM, SOAR, TIP, EDR and NDR platforms
Automate Indicator of Compromise (IOC) lifecycle management, including validation, scoring, expiry and removal
Build validation, exception handling, logging and monitoring into automated workflows
Maintain automation code through source control, peer review, testing and controlled CI/CD releases
Define data requirements for use cases and playbooks in line with the event logging strategy
Mentor colleagues and share knowledge across a cross-functional agile team
Required Experience




5+ years of hands-on experience designing and building cyber security automation playbooks and workflows in a large enterprise or government workplace
Integrating SIEM and SOAR platforms with enterprise security and ICT systems using REST APIs, webhooks, custom connectors and JSON
Strong scripting and development skills in Python, PowerShell, Ansible or similar
Practical knowledge of security operations, including incident triage, threat hunting, vulnerability management and incident response
Working knowledge of the PSPF, ISM, Essential Eight and NIST
Applying DevSecOps practices, including source control, peer review, automated testing, CI/CD and controlled releases
Translating security requirements into automated technical solutions and explaining outcomes to technical and non-technical stakeholders
Integrations across threat intelligence, EDR/NDR, identity and access management, vulnerability management, cloud security, firewalls, ticketing and CMDB platforms
Automating threat intelligence lifecycle management using STIX and TAXII
Detection-as-code and detection formats such as Snort, Suricata, Zeek, YAML and JSON
AI-enabled security operations tooling
Mentoring and documenting automation work for knowledge transfer within multidisciplinary teams
Security Clearance Requirements
Must be an Australian Citizen
Must have an AGSVA NV1 Security Clearance
Working Arrangements
Onsite for the first six weeks, then hybrid (minimum three days per week onsite)
Why Profectus
Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs.
We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.

📌 Cyber Security Automation Engineer (Canberra)
🏢 Profectus
📍 Canberra