Cyber Operations Security Expert

WattleCore Technologies Pty Ltd; Melbourne; On-site; AUD 120,000 - 170,000; Full time

Job summary

NDIA is seeking a Cyber Operations Security Expert to lead proactive monitoring, incident response, and cloud security across Azure/AWS environments. The role includes coordinating with the Director of Cyber Security Operations, overseeing forensic activities, and improving security controls for the Agency’s IT platforms.

Ideal candidates will demonstrate experience with SIEM systems (Sentinel, Splunk), security tooling, and threat hunting, with a focus on protecting data and systems in a

Qualifications

• Familiarity with SIEM systems and log analysis.
• Knowledge of the Information Security Manual (ISM) and cyber security concepts.
• Experience implementing Incident Response Frameworks (NIST SP 800-61, MITRE).
• Formal cyber security qualifications or industry certifications (Azure/AWS, Splunk).

Responsibilities

• Lead proactive monitoring, investigation, and mitigation of security incidents using SIEM tools.
• Analyse security events and identify suspicious activity across networks and systems.
• Direct incident response including initial and detailed investigations and forensics.
• Escalate incidents as needed and apply SOPs for incident handling.
• Be the SME for cloud security, active defence, and threat mitigation.
• Develop phishing simulations and threat intelligence reports.
• Collaborate with Security Operations and IT teams to implement controls.
• Mentor junior staff and contribute to process improvements.

Skills

SIEM

Cloud security

Threat hunting

Incident response

Endpoint security

Network security

Monitoring

Forensics

Education

Cyber security degree

Tools

Sentinel

Microsoft Defender 365

Azure Security Centre

Splunk

Job description

Clearance: Must be able to obtain NV1 on commencement Australian Citizens only

Summary

We are seeking a Cyber Operations Security Expert as below

• Role/s: EL1 Cyber Operations Security Expert
• The Cyber Operations Security Expert, will undertake technical cyber security activities under
• the leadership of the Director of Cyber Security Operations. The Cyber Operations Security
• Expert,must possess and demonstrate technical competency in areas of cloud security
• (Azure/AWS), endpoint and network security, threat intelligence and hunting, data loss
• prevention, vulnerability management, and incident response. The Cyber Operations Security
• Expert,will be required to support and contribute to the protection of the Agency’s systems,
• users, and data, to support NDIA’s objectives to “build a world-leading National Disability" Insurance Scheme".
• As part of the Cyber Security Operations team, the role will help ensure that NDIA has the
• capability to build and protect cyber-resilient information technology platforms and support
• strategic objectives.

Responsibilities

The role will involve the key responsibilities:

• Lead proactive monitoring, investigation, and mitigation of security incidents within security
• tools (including Sentinel, Microsoft Defender 365 stack, Azure Security Centre, Splunk )
• Analyse security event data and identifying suspicious/malicious activity from networks and systems
• Lead incident response activities including initial and detailed investigation, computer forensics, chain of custody implications
• Respond to events and incidents using established Standard Operating Procedures (SOPs)
• Be a point of escalation for complex incidents and act as a subject matter expert in areas of cloud security, active defence, and threat mitigation
• Develop and manage phishing simulations
• Research new and evolving threats and vulnerabilities to the Agency’s threat landscape
• Conduct log analysis and develop visualisation and reporting within Splunk
• Identify critical data sources required by cyber for ingestion and normalisation into the SIEMs
• Collaborate with Security Operations and IT engineers to implement security controls
• Supervise, mentor and develop junior staff, and identify areas of people, process, and defensive tool improvement
• Produce and disseminate incident response reports, activity reports, and intelligence and threat briefs

Qualifications

• Demonstrated familiarity with log aggregation and Security Incident and Event Management (SIEM) systems
• Knowledge of the Information Security Manual (ISM) and cyber security concepts.
• Demonstrated experience implementing and using Incident Response Frameworks (NIST SP 800-61 Incident Handling Guide, Mitre Frameworks)
• Formal tertiary qualifications or industry certifications in a cyber security related field (e.g.Azure/AWS, Splunk Certified)