Cyber Security Threat Engineer

The Network; Canberra; On-site; AUD 120,000 - 160,000; Full time

Job summary

The Network in Canberra, ACT is seeking an experienced Cyber Security Threat Detection Engineer to join its Federal Government cyber security operations team. You will develop and tune detection across enterprise SIEM, SOAR and EDR platforms, addressing AI threats and adversarial activity.

Essential experience includes hands-on SIEM/EDR/SOAR, threat modelling and AI security monitoring, with baseline clearance and Australian citizenship.

Qualifications

• Hands-on experience in threat detection across SIEM/SOAR/EDR environments.
• Experience with threat modelling and AI security monitoring.
• Knowledge of MITRE ATT&CK and security best practices.

Responsibilities

• Develop, test and tune detection rules across SIEM, SOAR and EDR.
• Conduct threat modelling and translate threats into detections.
• Monitor emerging AI security threats and implement protective monitoring.

Skills

Threat detection

Incident response

Threat modelling

AI security monitoring

SIEM

EDR

SOAR

Threat intelligence

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic

Python

Bash

CrowdStrike

Microsoft Defender for Endpoint

Carbon Black

Job description

Cyber Security Threat Detection Engineer - Federal Government

Must be Canberra, ACT based.

12 months + 2 x 12-month extensions

Baseline Clearance | Australian Citizenship Required

A modern environment Government department is seeking an experienced Threat Detection Engineer to join its Cyber Security Operations capability. The role will focus on developing and improving threat detection across enterprise SIEM, SOAR and EDR platforms, including emerging threats associated with AI platforms and services.

Key Responsibilities

• Develop, test and tune detection rules and use cases across SIEM, SOAR and EDR, including playbooks and incident response automation.
• Conduct threat modelling using MITRE ATT&CK, STRIDE or PASTA, translating threats, vulnerabilities and intelligence into effective detection coverage.
• Develop monitoring for emerging AI security threats, including prompt injection, data leakage, model abuse and adversarial activity.

Essential Experience

• Strong detection engineering experience across at least two SIEM platforms, such as Microsoft Sentinel, Splunk, QRadar or Elastic.
• Minimum 5 years' cyber security operations experience, with hands-on SIEM, SOAR, EDR, threat intelligence and incident response capability.
• Practical experience in threat modelling and AI security monitoring, ideally including Microsoft Copilot, Azure AI or enterprise AI platforms.

Highly Desirable

• Sigma rule development and experience translating detection logic between security platforms.
• Experience with CrowdStrike, Microsoft Defender for Endpoint or Carbon Black, plus Python/Bash security automation.
• Knowledge of MITRE ATLAS, OWASP LLM Top 10, NIST and ASD/ACSC AI security guidance, with relevant GIAC/SANS/CISSP certifications highly regarded.