Cyber Security Threat Engineer

The Network Technology Recruitment; Canberra; On-site; AUD 140,000 - 170,000; Full time

Job summary

The Network Technology Recruitment is seeking a Cyber Security Threat Detection Engineer for a Canberra-based federal government department. The role focuses on developing and improving threat detection across enterprise SIEM, SOAR and EDR platforms, with emphasis on AI threat monitoring and incident response automation.

You will work in a modern Cyber Security Operations capability, delivering detection rules, threat modelling using MITRE ATT&CK, and monitoring for advances in AI security such

Qualifications

• Strong detection engineering experience across at least two SIEM platforms, such as Microsoft Sentinel, Splunk, QRadar or Elastic.
• Minimum 5 years' cyber security operations experience, with hands-on SIEM, SOAR, EDR, threat intelligence and incident response capability.
• Practical experience in threat modelling and AI security monitoring, ideally including Microsoft Copilot, Azure AI or enterprise AI platforms.

Responsibilities

• Develop, test and tune detection rules and use cases across SIEM, SOAR and EDR, including playbooks and incident response automation.
• Conduct threat modelling using MITRE ATT&CK, STRIDE or PASTA, translating threats, vulnerabilities and intelligence into effective detection coverage.
• Develop monitoring for emerging AI security threats, including prompt injection, data leakage, model abuse and adversarial activity.

Skills

Threat Detection

SIEM

SOAR

EDR

Threat Modelling

AI Security Monitoring

Automation

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic

CrowdStrike

Microsoft Defender for Endpoint

Carbon Black

Python

Bash

Job description

Cyber Security Threat Detection Engineer - Federal Government

Must be Canberra, ACT based. 12 months + 2 x 12-month extensions. Baseline Clearance | Australian Citizenship Required.

A modern environment Government department is seeking an experienced Threat Detection Engineer to join its Cyber Security Operations capability. The role will focus on developing and improving threat detection across enterprise SIEM, SOAR and EDR platforms, including emerging threats associated with AI platforms and services.

Key Responsibilities

• Develop, test and tune detection rules and use cases across SIEM, SOAR and EDR, including playbooks and incident response automation.


• Conduct threat modelling using MITRE ATT&CK, STRIDE or PASTA, translating threats, vulnerabilities and intelligence into effective detection coverage.


• Develop monitoring for emerging AI security threats, including prompt injection, data leakage, model abuse and adversarial activity.

Essential Experience

• Strong detection engineering experience across at least two SIEM platforms, such as Microsoft Sentinel, Splunk, QRadar or Elastic.


• Minimum 5 years' cyber security operations experience, with hands-on SIEM, SOAR, EDR, threat intelligence and incident response capability.


• Practical experience in threat modelling and AI security monitoring, ideally including Microsoft Copilot, Azure AI or enterprise AI platforms.

Highly Desirable

• Sigma rule development and experience translating detection logic between security platforms.


• Experience with CrowdStrike, Microsoft Defender for Endpoint or Carbon Black, plus Python/Bash security automation.


• Knowledge of MITRE ATLAS, OWASP LLM Top 10, NIST and ASD/ACSC AI security guidance, with relevant GIAC/SANS/CISSP certifications highly regarded.