Cyber Threat Investigator

Velan Consulting Pty Ltd; Canberra; Hybrid; AUD 140,000 - 180,000; Full time

Job summary

Velan Consulting Pty Ltd is seeking a Lead Cyber Threat Analyst in Canberra with hybrid work arrangements and NV1 eligibility. The role focuses on threat hunting, malware analysis, incident response and intelligence-informed analysis to strengthen cyber defenses for federal and private clients.

The position requires senior expertise in cyber intrusion activities, threat modelling, and investigative methods across large ICT environments.

Qualifications

• Relevant tertiary qualifications or equivalent practical experience in cyber security.
• Excellent knowledge of cyber threat hunting, incident response and threat intelligence.
• Experience leading hunt and analysis of cyber threats in large enterprise or government settings.

Responsibilities

• Conduct proactive cyber hunt activities based on hypotheses and intelligence.
• Investigate cyber intrusion activity across networks, systems and data sources.
• Support incident response through technical triage, investigation, containment and reporting.
• Translate threat intelligence into threat modelling and actionable reporting.
• Collaborate with threat intelligence, detection, vulnerability management and other cyber teams to uplift defenses.
• Document investigative findings and recommendations clearly and defensibly.
• Mentor and transfer knowledge to APS staff within Hunt and Incident Response.
• Lead complex threat intelligence/modelling tasks and major information security incidents.

Skills

Intrusion detection

Threat modelling

Threat intelligence

Malware analysis

Reverse engineering

PowerShell

Python

Cyber incident investigation

Education

Relevant tertiary qualifications or equivalent practical experience in cyber security

CREST Certified Network Intrusion Analyst

CREST Certified Host Intrusion Analyst

CREST Certified Malware Reverse Engineer

Tools

Kibana

ELK Stack

QRadar

Extrahop

Threat Intelligence Platforms

SOAR platforms

PowerShell

Python

Job description

Velan Consulting Pty Ltd - Direct supplier to both Federal and Private clients.

Lead Cyber Threat Analyst (Multiple roles) | Canberra - Hybrid | Australian Citizens with NV1 | Long-term Contract

Working arrangements : Hybrid

The Labour Hire Worker is expected to work onsite for the first 6 weeks before a hybrid flexible working arrangement can be considered.

Job details

Cyber Threat Analysts need to understand cyber intrusion activities then use their research skills to provide reporting on threat modelling and intelligence.

The Senior Cyber Threat Analyst with cyber threat hunting, malware analysis, AI engineering and incident response skillset and expertise who will be responsible for understanding cyber intrusion activities and applying technical analysis, research and investigative methods to identify, assess and report on malicious or suspicious activity affecting the agency. The role supports proactive threat hunting, incident response, and intelligence-informed analysis to strengthen the agency’s cyber defensive posture.

Key duties and responsibilities

• Conduct proactive cyber hunt activities based on hypotheses, intelligence reporting, anomalous activity and identified risks.
• Investigate cyber intrusion activity and suspicious behaviour across networks, systems and data sources.
• Support incident response activities through technical triage, investigation, containment support and reporting.
• Research adversary tactics, techniques and procedures and translate findings into threat modelling and actionable reporting.
• Work closely with threat intelligence, detection, vulnerability management and other cyber teams to improve investigative outcomes and defensive uplift.
• Document investigative findings, methods, artefacts and recommendations in a clear and defensible manner.
• Contribute to knowledge transfer, mentoring and capability uplift of APS staff within the Hunt and Incident Response function.
• Ability to work across multiple cyber disciplines and contribute to technically complex operational outcomes.
• Manage intrusion and analysis work with the ability to make decisions on appropriate response and expedite as necessary.
• Manage complex threat intelligence/modelling tasks and/or threat assessments.
• Manage major Information Security incidents.
• Assist with corporate response to an Information Security incident.
• Identifies and implements improved controls to reflect changes in factors such as threat levels and legislation.
• Undertake advanced research into vulnerabilities or cryptography, including producing complex exploits, undertake effective reverse engineering and/or effectively researched mitigation bypasses.
• Analyse security risks, identify control deficiencies, develop remediation strategies and implement security engineering solutions within large and complex ICT environments.

Technical skills (continued)

• Understanding of investigation and forensic techniques and tools.
• Design, code, verify, test, document, amend and refactors moderately complex programs/scripts.
• SFIA:
• Intrusion Detection and Analysis level 5
• Threat Intelligence, Assessment and Threat Modelling level 5
• Research level 4
• Query tables within Advanced Hunting (using KQL) to identify logs that answer investigative questions i.e. Network Events, Email Events, and Device File Events.
• Create and store custom playbooks.
• Elastic
• Use Kibana Endpoint, Events, NET and TI feeds to identify logs that answer investigative questions, using KQL Lucene and/or ES|QL queries.
• Navigate dashboards, review and respond to security alerts, imported from Microsoft Defender and Qradar.
• GatewayPE - Extrahop:
• Identify Communications from hosts to external IPs and domains.
• Search Extrahop to identify if malicious domains have reached endpoints.
• Use available data to extrapolate the nature of network communications from hosts and enemy domains & IPs.
• Log02:
• Use Linux command line skills to navigate through log02 files, such as windows event and firewall logs.
• AUPDNS
• Use Threat Intelligence to interrogate potential communication with suspicious domains.
• Highly Desirable technologies:::
• Engine Server
• Malware Analysis tools
• HxD
• Sysinternal
• QRadar
• Windows Server
• Active Directory
• Identity and Access Management (IAM) technologies.
• Security Information Event management (SIEM) platforms:
• Microsoft Sentinel or equivalent.
• Security Orchestration, Automation and Response (SOAR) platforms.
• Vulnerability management platforms:
• Rapid7
• Tenable
• Endpoint Detection and Response (EDR) technologies.Cloud platforms:
• Amazon Web Services
• Network, firewall and infrastructure security technologies.
• Infrastructure hardening and security baseline implementation.
• Security automation and scripting:
• PowerShell
• Python.
• Security architecture and systems integration concepts.

Knowledge / Qualifications

Relevant tertiary qualifications, industry certifications or equivalent practical experience in cyber security will be regarded favourably

Relevant experience in cyber security operations, cyber threat analysis, incident response, digital forensics and threat hunting is required.

Other required cyber security knowledge and experience:

• Protective Security Policy Framework (PSPF)
• Information Security Manual (ISM)
• National Institute of Standards and Technology (NIST)
• Appropriate and relevant certifications including:
• CREST Certified Network Intrusion Analyst,
• CREST Certified Host Intrusion Analyst,
• CREST Certified Malware Reverse Engineer.

Technical skills

Essential Technical skills and knowledge: Cyber threat hunting, Cyber incident investigation, or cyber security operations. Analyse logs, artefacts and system data to identify indicators of compromise, anomalous behaviour and intrusion activity. Understanding of attacker tactics, techniques and procedures and how they are applied in an enterprise environment. Technical reporting, investigative outputs and intelligence-informed assessments.

• 1.Demonstrated ability leading hunt and analysis of cyber threats: Identifies threats within research conducted or provided. Constructs Hunt exercises based on research which apply to the agency, and agency systems. Identifies ICT critical assets (e.g. endpoints, servers, gateways) using technical tools and network maps. Contextualizes why assets are important.
• 2.Demonstrated ability to lead, engage, influence, communicate and collaborate with a broad range of stakeholders, including senior executives, technical specialists, business representatives, other government agencies/departments and external providers.
• 3.Demonstrated and proven experience performing the duties and responsibilities relevant to the role being applied for, including the required technical skills, technologies, frameworks, methodologies identified in the RFQ.
• 4.Demonstrated understanding and practical application of cyber security operations and risk management principles, including threat detection, hunting and analysis, security monitoring, threat intelligence, vulnerability management, incident response and relevant Australian Government security frameworks such as the PSPF, ISM and Essential Eight.
• 5.Demonstrated ability to communicate complex technical and cyber security concepts to both technical and non-technical audiences and contribute to capability uplift through mentoring, collaboration and knowledge transfer activities.
• 1.Experience working within large-scale enterprise environments involving cloud platforms, identity and access management, security operations, infrastructure, applications and data services.
• 2.Demonstrated ability to deliver outcomes within tight timeframes while managing competing priorities, dependencies and stakeholder expectations.
• 3.Demonstrated and proven experience performing the duties and responsibilities relevant to the specialised sub role (Senior Cyber Threat Hunter, Senior Malware Analyst, Senior AI Engineer), including the required technical skills, technologies, frameworks and methodologies identified/applicable.
• 4.Demonstrated experience identifying, assessing and managing cyber security risks, vulnerabilities, compliance obligations and remediation activities. Demonstrated experience engineering threat analysis tool integrations across a broad enterprise security ecosystem, including technologies such as threat intelligence platforms, endpoint or network detection and response, identity and access management, vulnerability management, cloud security, firewalls and case management. Demonstrated experience designing continuously improving cyber security automation within a large and complex enterprise or government environment i.e. automated security workflows or playbooks supporting detection, alert triage, investigation, threat hunting, containment, remediation or incident response.