Cyber Security Analyst

Tardis Group; Sydney; On-site; AUD 110,000 - 150,000; Full time

Job summary

Tardis Group is seeking a hands-on Cybersecurity Operations Analyst to join a growing team supporting a complex, mission-critical Defence capability. This role offers the chance to move beyond alert triage and take real ownership of security across a multi-site environment.

You will monitor security events, review logs from diverse sources, identify threats and coordinate incident response while working with engineering and IT teams to implement practical security improvements.

Qualifications

• 3+ years’ experience in cyber security operations or related security role.
• Hands-on experience reviewing logs, investigating events and responding to incidents.
• Experience using Splunk or comparable SIEM/log-analytics platform to investigate events and support incident response.
• Experience implementing threat-response actions, including blocking indicators and coordinating remediation.
• Comfortable working across Windows and Linux environments.
• Ability to investigate issues across complex systems and piece together incomplete information.
• Strong communication skills to explain risks to stakeholders.
• Australian citizenship and eligibility for NV1 security clearance.

Responsibilities

• Monitor security events and investigate potential threats across systems, networks and applications.
• Review and analyse logs from endpoints, servers, firewalls, network devices, cloud platforms and other security tools.
• Identify suspicious activity, security incidents and indicators of compromise.
• Respond to security threats by implementing containment actions, such as blocking malicious indicators.
• Coordinate and support incident response activities, including post-incident review.
• Manage vulnerabilities end to end, including scanning, prioritisation and remediation follow-up.
• Support continuous monitoring, threat detection, risk identification and reporting.
• Collaborate with engineering and IT teams to implement security improvements.
• Contribute to security uplift initiatives and mature cyber security capability.
• Communicate risks and remediation actions clearly to technical and non-technical stakeholders.

Skills

Cyber security operations

SOC

Log analysis

Incident response

Splunk

Windows and Linux

Communication skills

NV1 security clearance

Tools

Splunk

Job description

Seeking a hands-on Cybersecurity Operations Analyst to join a growing team supporting a complex, mission-critical Defence capability. This is an opportunity to move beyond alert triage and take real ownership of security across a multi-site environment.

You will work across systems, networks and security tooling to identify vulnerabilities, investigate security events, respond to threats and strengthen the organisation’s security posture. The environment is complex and evolving, with multiple locations, technologies and data sources that do not always integrate cleanly—making this a role for someone who enjoys practical problem-solving and continuous improvement.

What you’ll do

• Monitor security events and investigate potential threats across systems, networks and applications.
• Review and analyse logs from endpoints, servers, firewalls, network devices, cloud platforms and other security tools.
• Identify suspicious activity, security incidents and indicators of compromise.
• Respond to security threats by implementing appropriate containment and blocking actions, such as blocking malicious IP addresses, domains, URLs, users or devices.
• Coordinate and support incident response activities, including investigation, escalation, containment, remediation and post-incident review.
• Manage vulnerabilities end to end, including scanning, prioritisation, tracking exposures, remediation follow-up and reporting.
• Support continuous monitoring, threat detection, risk identification and security reporting.
• Work closely with engineering, infrastructure and system-administration teams to implement practical security improvements.
• Contribute to security uplift initiatives, process improvement and the maturing cyber security capability.
• Communicate risks, findings and remediation actions clearly to technical and non-technical stakeholders.

What you’ll bring

• Approximately 3+ years’ experience in cyber security operations, SOC, systems administration, network security or a related technical security role.
• Hands-on experience reviewing logs, investigating security events and responding to incidents.
• Experience using Splunk or a comparable SIEM/log-analytics platform to investigate events, build searches, monitor security activity and support incident response, is prefereable
• Experience implementing threat-response actions, including blocking malicious indicators, isolating affected systems where appropriate and coordinating remediation.
• Comfortable working across Windows and Linux environments.
• Ability to investigate issues across complex systems and piece together incomplete or fragmented information.
• Strong communication skills, with the ability to explain technical risks and security issues to technical and business stakeholders.
• Australian citizenship and eligibility to obtain and maintain an Australian Government security clearance (NV1).