Cyber Defence Analyst

Medibank; Melbourne; On-site; AUD 90,000 - 130,000; Full time

Job summary

Medibank is seeking a Cyber Defence Analyst to join the Cyber Defence Team in Melbourne. You will monitor security alerts, investigate incidents, and apply ATT&CK-based analysis to detect and respond to threats.

This role collaborates with senior analysts to strengthen detection, response and threat hunting capabilities across endpoint, identity, network and cloud telemetry. You will work in a 24x7 security operations environment, leverage SIEM/EDR tools, and contribute to the ongoing

Qualifications

• Minimum 4 years’ experience in security operations or cyber defence.
• Experience with detection-as-code or threat hunting in 24x7 SOC.
• Strong in security alert triage and incident investigations.
• Experience with SIEM/EDR platforms and telemetry sources.
• Familiarity with attacker techniques and MITRE ATT&CK framework.

Responsibilities

• Monitor, triage and investigate security alerts across endpoint, identity, network and cloud telemetry.
• Perform initial incident analysis to understand scope, severity and impact.
• Escalate complex activity to senior analysts with evidence.
• Apply knowledge of attacker TTPs when analyzing alerts and incidents.
• Use MITRE ATT&CK to categorise activity and support investigations.
• Support maintenance and tuning of detections.
• Participate in threat hunting and control uplift activities.
• Maintain investigation notes, timelines and findings.
• Collaborate with incident response, IT and security engineering teams.

Skills

Detection-as-code

Threat hunting

SOC operations

Security alert triage

Incident investigations

MITRE ATT&CK

SIEM/EDR platforms

Analytical skills

Telemetry (email, endpoint, identity,

Education

Security certifications (Security+, BTL L1/L2, GCIH)

Tools

Microsoft Security Suite

Splunk / Falcon NGSiem

CrowdStrike

Falcon Suite

Job description

At Medibank Group, our brands, Medibank, ahm and Amplar Health, are united by a shared purpose: creating the best health and wellbeing for Australia. We're building a workplace where people can thrive, grow and make a meaningful impact, while helping shape a healthier future for our customers, patients and communities.

We’re looking for a Cyber Defence Analyst to join our Cyber Defence Team and support the day-to-day identification, investigation and response to security threats.

In this role, you’ll work across security alert analysis, incident investigation and threat hunting, applying your understanding of attacker behaviour and the MITRE ATT&CK framework to help identify and respond to potential threats.

Working alongside senior analysts and specialists, you’ll contribute to the effectiveness and reliability of the cyber defence function while continuing to develop your capability across security operations.

The Responsibilities:

• Monitor, triage and investigate security alerts across endpoint, identity, network and cloud telemetry.
• Perform initial incident analysis to understand scope, severity and potential impact.
• Escalate complex or high-risk activity to senior analysts or incident responders with clear supporting evidence.
• Apply your knowledge of attacker tactics, techniques and procedures when analysing alerts and incidents.
• Use the MITRE ATT&CK framework to categorise activity, support investigations and understand attack progression.
• Support the maintenance, improvement and tuning of existing detections.
• Participate in threat hunting activities and supporting control uplift activities.
• Maintain clear investigation notes, timelines and findings.
• Collaborate with incident response, IT and security engineering teams as required.

About you:

• A minimum of 4 years’ experience in security operations, cyber defence or a related role.
• Experience with detection-as-code, threat hunting or working within a 24×7 SOC or enterprise security operations environment.
• Strong experience performing security alert triage and incident investigations.
• Experience in one or more of the following: Microsoft Security Suite, Splunk / Falcon NGSiem, CrowdStrike, Falcon Suite.
• Email, Endpoint, identity, network or cloud telemetry.
• Working knowledge of common attack methodologies and adversary behaviour.
• Familiarity with the MITRE ATT&CK framework and its use within security operations.
• Experience using one or more SIEM or EDR platforms.
• Strong analytical skills and attention to detail with ability to work independently on assigned tasks while following established processes.
• Entry or intermediate security certifications such as Security+, BTL L1/L2 or GCIH are also desirable.

Why work for Medibank Group?

At Medibank Group, we're creating Australia's healthiest workplace by putting the health, wellbeing and success of our people at the centre of everything we do. We know that when people feel supported, connected and empowered to be themselves, they do their best work.

That's why we invest in flexible ways of working, career growth, wellbeing support and meaningful experiences that help our people thrive both professionally and personally.

To learn about what’s in it for you, visit https://careers.medibank.com.au/the-medibank-experience

Be Yourself. Belong Here

We’re committed to a workplace where everyone feels safe, supported, and free to be themselves. By embracing diverse perspectives, we challenge the status quo and uncover better ideas. You can confidently bring your whole self—because your unique voice is what makes us stronger.

We welcome and encourage applications from people of all backgrounds, identities and lived experiences, including Aboriginal and Torres Strait Islander peoples, people from culturally and linguistically diverse backgrounds, LGBTQIA+ communities, people with disability, neurodivergent people, and carers.

Our employee networks create space for connection, advocacy and allyship. We offer flexible ways of working to support inclusion, accessibility and wellbeing.

Medibank proudly recognised as Best Enterprise Organisation, 2026 AFR BOSS Best Places to Work