Cyber Security Operations Analyst L5 - L6

Australian Secret Intelligence Service; Canberra; On-site; AUD 90,000 - 130,000; Full time

Job summary

Australian Secret Intelligence Service is seeking a Cyber Security Operations Analyst at L5–L6 to monitor, detect, and respond to cyber threats across our ICT environment. You will analyse logs with SIEM, conduct proactive threat hunting, and manage incident response to contain and eradicate threats.

The role requires strong skills in security analytics, scripting, and stakeholder communication, with opportunities to mentor teammates and enhance detection capabilities.

Qualifications

• Proven experience in cyber security operations across monitoring, detection and response.
• Knowledge of SIEM software, data analytics tools, and scripting (SQL, Python, PowerShell).
• Experience in incident response, digital investigations, and threat hunting valued.
• Certifications and demonstrated application of knowledge are highly regarded.
• Bachelor-level degree in security-related field preferred, not essential.

Responsibilities

• Monitor, detect, and respond to malicious cyber activity to protect systems and data.
• Analyse logs from applications, hosts, and networks using SIEM and hunt threats.
• Prepare and manage cyber incident response activities to quickly contain threats.
• Develop dashboards, use cases, and threat detection capabilities across ICT.
• Leverage intelligence and data holdings to provide actionable insights.
• Mentor team members on cyber security operations best practices.

Skills

Risk management

Incident response

Security analytics

Policy advisory

Stakeholder engagement

Communication skills

Education

Bachelor's degree in Cyber Security / CS / IT

Professional certifications in cyber security

3+ years experience in cyber security operations

Tools

SIEM

Data analytics platforms

SQL

Python

PowerShell

Job description

Cyber Security Operations Analyst L5 - L6

In this dynamic position, you will monitor, detect, and respond to malicious cyber activity, working to protect the confidentiality, integrity, and availability of our systems and sensitive data. From analysing log data through Security Information and Event Management (SIEM) platforms to conducting proactive threat hunting, your work will directly impact our ability to identify, contain, and eradicate threats to ASIS.

Role responsibilities

• Monitor, detect, and respond to malicious cyber activity targeting ASIS's ICT environment to protect the confidentiality, integrity, and availability of systems and data
• Analyse log data from applications, hosts, and network traffic using SIEM software and conduct proactive cyber threat hunting activities
• Prepare for and manage cyber incident response activities, working to quickly identify, contain, and eradicate threats
• Develop dashboards, use cases, and threat detection capabilities to improve cyber security, and proactively identify and remediate capability and coverage gaps across the ICT environment
• Leverage advanced technologies, intelligence analysis, and data holdings to provide actionable insights and support other business areas
• Mentor and coach team members on cyber security operations best practices

Core skills

We encourage applicants with the following skills and attributes to apply:

• Familiarity with risk management, incident response, and investigative best practices, including experience in security analytics and developing reporting for various customers.
• Demonstrated understanding of Australian Government cyber security frameworks, including the Protective Security Policy Framework (PSPF) and Information Security Manual (ISM).
• Strong background in cyber security capabilities and tools, including SIEM, data analytics platforms, and query/coding languages such as SQL, SPL, Python, and PowerShell.
• Demonstrated understanding of at least one technology domain, such as infrastructure, virtualisation, databases, software development, data analytics or machine learning.
• Proven ability to work under limited direction with reasonable autonomy, demonstrating initiative, judgment, and strategic thinking to solve complex problems and manage workflows.
• Excellent communication and stakeholder engagement skills, with the ability to provide detailed technical and policy advice, articulate cyber best practices, and manage sensitive issues.

Education and qualification requirements

The following education, qualifications and/or experience will be highly regarded:

• Proven experience in cyber security operations, including monitoring, detecting, and responding to malicious cyber activity
• Proficiency in Security Information and Event Management (SIEM) software, data analytics platforms, and query/coding languages (e.g., SPL, SQL, Python, PowerShell) is highly desirable
• Previous incident response experience, such as digital forensics, malware analysis and incident investigations will be highly valued
• Professional certifications along with demonstrated application of knowledge will be highly regarded
• Bachelor's degree in Cyber Security, Computer Science, or Information Technology (not essential)
• 3+ years of experience in a cyber security operations or analyst role, preferably within an enterprise or government environment

To be eligible for a role you must:

• Be an Australian citizen
• Be assessed as suitable to hold and maintain a TOP SECRET-Privileged Access security clearance
• For more information on eligibility please see the Protective Security Policy Framework which is publicly accessible at protectivesecurity.gov.au, section 12 provides information on Eligibility and suitability