Work options: Hybrid

We have an exciting opportunity for a Defensive Response Specialist to join the team!

This role will be responsible for group-level coordination and support for cyber security incident management and response impacting Divisions, and provide group-level visibility into identification, containment and PIR efforts. Where required, the role will guide divisional teams in investigation, containment and recovery in line with industry best practice. The role also turns incident findings into prioritised uplift recommendations, and builds the playbooks, exercises and reporting that lift incident response maturity across the Group.

Our Group Cyber Security (GCS) team is responsible for leading strategy, architecture and risk approaches for cyber security across the Wesfarmers Group to ensure objectives are met and that we operate within risk appetite. In addition, the team coordinates incident response and intelligence activities across the Wesfarmers Group (for significant events) while partnering with our businesses to improve their cyber threat preparedness.

What You’ll Do

- In collaboration with the GCS team, define and guide technical control requirements to prevent, detect and respond to observed and emerging threats.
- Support initiatives that strengthen Security Operations Centre capability and defensive response maturity across GCS and Wesfarmers divisions, including adoption of relevant practices and technologies.
- Develop and maintain investigation playbooks and support the continuous improvement of incident response protocols, case management, reporting and analytics.
- Maintain awareness of emerging cyber threats and developments in cyber defence and intelligence, and recommend proportionate improvements to defensive practices.
- Promote knowledge sharing across the Group to strengthen cyber defence, incident response capability and collective preparedness.
- Coordinate the Group-level response to significant and complex cyber security incidents, particularly during identification, investigation and containment.
- Help establish the investigation strategy and drive decisions through identification, containment, eradication and recovery.
- Establish incident scope, impact and likely root cause by testing hypotheses against available evidence and constructively challenging assumptions.
- Support hands-on investigative support across endpoint, identity, network and cloud environments,



using Microsoft Sentinel, other SIEM platforms and EDR tools.
- Maintain explicit and timely communication with GCS leadership and divisional stakeholders on incident status, business impact, key risks and decisions required.
- In collaboration with other GCS functions, define and guide the technical control requirements that should be in place and operating to detect and prevent noted threats.
- Support or contribute to after-action and post-incident reviews to identify root causes, control gaps and opportunities to strengthen Group preparedness and defensive capability.
- Recommend prioritised uplift actions to divisions and track agreed recommendations through to closure, reporting progress and recurring themes to GCS leadership.
- Translate incident findings into practical cyber defence techniques, guidance and reports that can be shared across the Group.

What You’ll Need

- At least 6 years’

experience in cyber security, including at least 3 years in hands on incident response.

- Demonstrated experience leading the response to several significant cyber security incidents in a large or multi business environment.
- Hands on investigation experience across endpoint, identity, network and cloud environments.
- Experience with Microsoft Sentinel and at least one other SIEM platform, and with EDR platforms and other security technologies leveraged during incident response and management.
- Skill and experience in protecting a network against malware and malware analysis concepts and methodologies.
- Skill and experience in identifying, capturing, containing, and reporting malware.
- Skill and experience in digital forensics, evidence handling and large-scale log analysis.
- Skill and experience in performing impact assessments and applying attack frameworks such as MITRE ATT&CK.;
- Tertiary qualifications in a Computer Science, Software Engineering, Information Technology, or a Cyber Security specialisation.
- Industry-recognised certifications in incident response and digital forensics (for example GCFA,



GCFE or GCIH) highly regarded.

About Wesfarmers As one of Australia’s largest listed companies, we’re proud of our longstanding contribution to Australians.

We continually reinvent ourselves and invest in the businesses we own and operate, including leading retailers like Bunnings, Kmart, Target, Officeworks and Priceline. We also have an online offering, including OnePass and the Group shared data asset. Our work doesn’t stop there, we operate in the industrials sector which supplies the nation with chemicals, energy and fertilisers, and industrial and safety products.

And we participate in an integrated lithium joint venture, including the operation of a mine and concentrator and the development of a refinery.

Join the team at Corporate Office which provides support and advice across the Wesfarmers Group The Corporate Office provides corporate services and support to the autonomous businesses within the Wesfarmers Group, enabling the achievement of Group objectives. It leads capital allocation and portfolio management for the Group and focuses on leveraging and enhancing the Group’s reputation to support attraction and retention of talent, securing investment opportunities and maintaining a low-cost capital. To do this, we need great people, working together and role modelling our values and ways of working.

Our culture

We’re results focused, but we’re a business that cares. Here we are less about titles and more about everyone playing a valuable role. We provide autonomy and space with freedom to operate, quickly learning from mistakes because we know they are part of the way forward. We’re curious, open minded, and collaborative. And although we’re thought leaders, we’re humble, and willing to share knowledge and learn from one another.

We know that diversity fosters greater innovation and better customer connection, so we strive to create an inclusive and diverse work environment.

Next steps

If this sounds like your next career move, click on the ‘Apply’ button. Please note that we may commence interviewing of candidates prior to this closing date.

We’re hiring the best and the brightest talent. Let’s start to explore the possibilities of achieving great things together.

For more information, visit our website at https://www.wesfarmers.com.au

Confidentiality is assured.

📌 Defensive Response Specialist (Melbourne)
🏢 Wesfarmers
📍 Melbourne