Cyber Threat Detection & Response Analyst

Morgan McKinley; Sydney; On-site; AUD 90,000 - 130,000; Full time

Job summary

Morgan McKinley in Sydney is seeking an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.

You'll work in a high-performing security team, leveraging Splunk to detect, investigate and respond to threats across web applications, networks and endpoints, and contribute to continuous improvement of security operations.

Qualifications

• 3–6 years' experience in a security analytics role.
• Strong intrusion analysis background with log interpretation.
• Solid understanding of web applications and HTTP/HTTPS, DNS, TLS.
• Knowledge of web app attack vectors (SQLi, XSS, RFI).
• Experience with incident response and end-to-end investigations.
• Scripting and regex proficiency; familiarity with enterprise client/server architecture.
• Experience with WAF and CDN security controls.

Responsibilities

• Analyse web, application, authentication, endpoint and security logs to identify malicious activity.
• Use Splunk to investigate security events, build macros, alerts and dashboards.
• Identify exploits and patterns from logs and events.
• Interpret Apache, IIS and AD logs alongside other security data sources.
• Detect anomalous network activity using analytics and tooling.
• Support incident response and help implement mitigations, including WAF/CDN controls.
• Interpret stateful firewall rules and contribute to SOC procedures.

Skills

Threat analysis

Incident response

Log analysis

Regex scripting

SOC operations

Web security fundamentals

Splunk

WAF

CDN security controls

Tools

Splunk

WAF

Akamai CDN

Firewall rules

Job description

Morgan McKinley in Sydney is seeking an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.

You'll work in a high-performing security team, leveraging Splunk to detect, investigate and respond to threats across web applications, networks and endpoints, and contribute to continuous improvement of security operations.