Cyber Defence Technical Lead - Detection, Automation & Intelligence

Head Office - Sydney; Sydney; On-site; AUD 180,000 - 280,000; Full time

Benefits offered by this job

Competitive remuneration

Professional development opportunities

Employee benefits and Ramsay Rewards

Job summary

Ramsay Health Care seeks a senior Cyber Defence Technical Lead to drive detection engineering, automation and intelligence across a large healthcare hybrid SOC. This hands-on leadership role shapes automated detection, integrates security technologies and enhances telemetry health to protect patient data.

You will lead incident response playbooks, collaborate with MSSPs and internal teams, and translate threat intelligence into effective detection and response capabilities in a regulated

Qualifications

• Extensive cybersecurity experience within a large enterprise environment.
• Strong hands-on experience across detection engineering, SIEM, EDR and SOAR platforms.
• Experience developing automated incident response workflows and API integrations.
• Knowledge of data parsing, telemetry pipelines and security monitoring.
• Familiarity with MITRE ATT&CK and threat modelling.

Responsibilities

• Lead detection engineering, rule development and tuning aligned to MITRE ATT&CK.
• Design, develop and refine automated incident response playbooks and SOAR workflows.
• Monitor log ingestion pipelines to maintain telemetry health and visibility.
• Build and manage API integrations across security tech stack.
• Operationalise threat intelligence to support proactive threat hunting and SOC workflows.
• Lead root cause analysis and post-incident engineering improvements.
• Collaborate with internal teams and external partners to improve security platforms.

Skills

Detection engineering

SIEM

EDR

SOAR

APIs

Threat intelligence

MSSP/MSP collaboration

Education

Cybersecurity degree

Tools

SOAR platforms

Job description

Head Office - Sydney – St Leonards Park NSW

Ramsay Health Care is seeking a senior, highly technical Cyber Defence Technical Lead – Detection, Automation & Intelligence to play a key role in protecting our digital environment, systems and patient data. Reporting to the SOC Manager, this hands‑on technical leadership role will drive detection engineering, security automation and the ongoing health of telemetry across Ramsay’s hybrid Security Operations Centre (SOC). Acting as the technical 2IC, you will help shape the evolution towards an increasingly automated, agentic SOC, ensuring detection capabilities are continuously optimised, security technologies are seamlessly integrated, and emerging threats are identified and addressed effectively. Working across a large and complex healthcare environment, you will combine deep technical expertise with the opportunity to influence Ramsay’s cyber defence capabilities, strengthen operational resilience and protect critical information assets.

What You’ll Do

• Lead detection engineering, detection rule development and tuning, and continuous mapping to the MITRE ATT&CK framework.
• Design, develop and refine automated incident response playbooks and Security Orchestration, Automation and Response (SOAR) workflows.
• Monitor, baseline and audit log ingestion pipelines to maintain telemetry health, identify gaps and ensure consistent security visibility.
• Build and manage API integrations and telemetry connectors across Ramsay’s security technology stack.
• Operationalise threat intelligence to support proactive threat hunting and the development of autonomous, agentic SOC workflows.
• Act as the technical quality assurance lead for our Managed Security Service Provider (MSSP), validating escalations, assessing detection effectiveness and driving continuous improvement.
• Lead root cause analysis, threat modelling and post-incident engineering improvements to strengthen detection and response capabilities.
• Collaborate with internal technology teams and external security partners to improve the integration and effectiveness of security platforms.

What You’ll Bring

You are a highly technical cybersecurity professional with extensive experience in enterprise security operations, detection engineering and security automation. You bring a hands‑on approach to solving complex technical challenges, a strong understanding of evolving cyber threats and the ability to translate security intelligence into effective detection and response capabilities.

You will bring:

• Extensive cybersecurity experience within a large enterprise environment.
• Strong hands‑on experience across detection engineering, SIEM, EDR and SOAR platforms.
• Demonstrated experience designing, tuning and maintaining detection rules and security use cases.
• Experience developing automated incident response workflows and integrating security technologies through APIs.
• Strong technical knowledge of data parsing, log ingestion, telemetry pipelines and security monitoring.
• A sound understanding of the cyber threat landscape, adversary tactics, techniques and procedures (TTPs), and frameworks such as MITRE ATT&CK.
• Experience working with MSSPs, Managed Service Providers (MSPs) and hybrid SOC operating models.
• Strong analytical and problem‑solving skills, with the ability to investigate complex incidents and drive technical improvements.

Desirable but not essential

• A degree in Cybersecurity, Information Technology or a related discipline.
• Experience working within healthcare, critical infrastructure or another highly regulated environment.
• Relevant technical certifications, such as GIAC Certified Detection Analyst (GCDA), GIAC Cyber Threat Intelligence (GCTI) or GIAC Certified Security Automation (GCSA).
• Hands‑on experience with Python scripting, API orchestration and advanced security automation.

About Us

Founded in Australia in 1964, Ramsay Health Care is the nation’s largest private hospital operator and a recognised global leader in healthcare delivery. Across Australia, Ramsay operates 76 hospitals and 12 surgical centres, caring for more than 1.1 million patients each year with the support of over 30,000 dedicated professionals. Guided by our ethos, “People Caring for People,” we are committed to delivering exceptional patient care, building meaningful relationships, and driving continuous improvement and sustainable growth. In addition to our hospital network, Ramsay operates a growing community pharmacy network of more than 35 locations. Through our culture, The Ramsay Way, we place our people at the centre of everything we do—fostering collaboration, empowering teams, and achieving outstanding outcomes for patients and communities.

• Competitive remuneration and a comprehensive range of employee benefits.
• Professional development and career progression opportunities.
• Access to Ramsay Rewards and exclusive retailer discounts.
• The opportunity to influence the evolution of cyber defence capabilities across a large, complex healthcare environment.
• A technically challenging role with scope to drive detection engineering, automation and next‑generation SOC initiatives.