Cyber Security Engineer - Detection Engineering (Microsoft Sentinel)

Pathway Search LLC.; North Sydney Council; Hybrid; AUD 144,000 - 176,000; Full time

Benefits offered by this job

Hybrid working

Onsite three days a week

Job summary

Pathway Search LLC is seeking a Cyber Security Engineer for Detection Engineering (Microsoft Sentinel) in North Sydney. The role focuses on building and owning Microsoft Sentinel and Defender detection capabilities, not SOC triage, with collaboration across a managed SOC provider.

You will design analytics rules, write KQL queries, and improve coverage while reducing false positives across the security stack. Hybrid work with three days onsite. Australian work eligibility required.

Qualifications

• Hands-on experience building and tuning Sentinel analytics rules and Defender detections.
• Strong working knowledge of KQL and threat hunting techniques.
• Solid understanding of Windows log sources and telemetry routing to SIEM.

Responsibilities

• Design, build and tune Microsoft Sentinel analytics rules and Defender detections.
• Write and maintain KQL queries for threat hunting and detection logic.
• Improve platform coverage and reduce false positives across the Microsoft security stack.
• Collaborate with the managed SOC provider and own the detection logic they operate against.

Skills

Sentinel analytics

KQL

Defender detections

Windows logs

SOC collaboration

Tools

Microsoft Sentinel

Job description

Cyber Security Engineer - Detection Engineering (Microsoft Sentinel)

Our client is one of Australia's largest private operators in critical infrastructure, based in North Sydney. They're growing out their internal security function and looking for a Cyber Security Engineer to build and own their Microsoft Sentinel and Defender detection capability.

This is an engineering role, not a SOC or triage position. The organisation runs a managed SOC for alert monitoring and response, so this role sits above that, writing and tuning detection logic, developing analytical rules, and improving platform coverage across Sentinel and Defender.

What You'll Do

• Design, build and tune Microsoft Sentinel analytics rules and Defender custom detections
• Write and maintain KQL queries for threat hunting, log coverage analysis and detection logic
• Improve platform coverage and reduce false positives across the Microsoft security stack
• Work closely with the managed SOC provider, owning the detection logic they operate against
• Translate purple team and red team findings into new or tuned detections
• Communicate detection and risk findings to internal technical stakeholders

About the Role

Our client is one of Australia's largest private operators in critical infrastructure, based in North Sydney. They're growing out their internal security function and looking for a Cyber Security Engineer to build and own their Microsoft Sentinel and Defender detection capability.

This is an engineering role, not a SOC or triage position. The organisation runs a managed SOC for alert monitoring and response, so this role sits above that, writing and tuning detection logic, developing analytical rules, and improving platform coverage across Sentinel and Defender.

What You'll Do

• Design, build and tune Microsoft Sentinel analytics rules and Defender custom detections
• Write and maintain KQL queries for threat hunting, log coverage analysis and detection logic
• Improve platform coverage and reduce false positives across the Microsoft security stack
• Work closely with the managed SOC provider, owning the detection logic they operate against
• Translate purple team and red team findings into new or tuned detections
• Communicate detection and risk findings to internal technical stakeholders

What We're Looking For

• Hands-on experience building and tuning Sentinel analytics rules and/or Defender detections, not just responding to alerts
• Strong working knowledge of KQL
• Solid understanding of Windows log sources and how security telemetry actually reaches a SIEM
• Comfortable working directly with a managed SOC provider rather than running triage yourself
• Australian citizens or permanent residents only. We are unable to offer visa sponsorship for this role
• Based in Sydney and able to work onsite three days a week

What's on Offer

• $160,000 base + superannuation + 20% performance-linked STIP
• Hybrid working, three days a week onsite in North Sydney
• The chance to build detection capability from the ground up at a genuine critical infrastructure operator