Detection and Response Engineer

DroneShield; Sydney; On-site; AUD 120,000 - 160,000; Full time

Job summary

DroneShield is seeking a Detection and Response Engineer to join the Security team in Sydney, NSW. You will own and evolve our detection strategy, integrating tooling, threat intel, and incident response practices to protect our hardware and software assets.

The role requires hands-on security operations, incident triage, and collaboration with engineering and IT. You will develop automation, runbooks, and metrics to improve detection coverage and response speed in a fast-paced, high-stakes

Qualifications

• 3-6 years of experience in security operations, incident response, or detection engineering.
• Hands-on experience investigating security incidents in cloud or enterprise environments.
• Familiarity with SIEM platforms and log analysis.
• Basic scripting or programming experience (Python, Bash, KQL, Go or Powershell)

Responsibilities

• Develop, tune, and maintain detection rules across SIEM and security tooling.
• Improve signal-to-noise ratio by reducing false positives and enhancing alert fidelity.
• Investigate and respond to security incidents across endpoints, cloud, and SaaS environments.
• Support incident handling from detection through containment, eradication, and recovery.
• Conduct post-incident reviews (RCA) and contribute to lessons learned.
• Identify gaps in detection and response capabilities and propose improvements.

Skills

Security operations

Incident response

Detection engineering

Python

Linux

Cloud platforms

Tools

SIEM platforms

Cloud tooling

Job description

Work with cutting-edge AI technology that helps make the world a safer and more secure place. DroneShield (ASX:DRO) develops market-leading counter-drone solutions used by military organisations, government agencies, airports, critical infrastructure operators, and law enforcement operating in some of the most challenging and high-stakes environments in the world. Employees work at the forefront of innovation, solving complex technical problems and delivering mission-critical capabilities where performance, reliability, and speed matter.

As an ASX200-listed company and the world's only publicly listed pure-play counter-drone business, DroneShield is experiencing rapid growth. Revenue increased from A$57 million in 2024 to more than A$217 million in 2025, supported by record profitability, a global sales pipeline exceeding A$2.5 billion, and annual R&D investment of over A$50 million.

Since 2017, DroneShield has grown from 11 employees to more than 550 globally, with operations across Australia, the United States, Europe, and the Middle East, supporting customers in over 70 countries.

The role is based at DroneShield's Sydney headquarters, which houses corporate, commercial, engineering, and operational teams supporting the company's global growth and customer base.

About The Role

DroneShield is seeking a Detection and Response Engineer with relevant experience to join the Security team in Sydney, NSW.

The Security team is a nimble team responsible for protecting DroneShield's assets and users. Our adversaries are sophisticated and use state-of-the-art tooling. To protect DroneShield, we need to focus on the biggest risks, eliminate threats, focus on automation to scale our efforts and continually increase the cost for the attackers.

Key responsibilities for this role include own and improve our existing detection strategy, including tooling, custom detections, process, threat intelligence etc. This role will also be responsible for the response strategy including handling incidents, being incident commander, staff training, tooling and others. Other areas this role will influence and/or drive change are corporate security and vulnerability management.

Detection and Response should be viewed as a closed loop. Detections should enhance responses and focus on providing enriched information to responders and improving the signal-to-noise ratio. Responders should leverage automated playbooks to respond to incidents as quickly as possible and use incident reviews as opportunities to improve or create new detections.

The ideal candidate will have a strategic view of both spaces and will drive change so that this loop works well – they will improve and implement our detection strategy to facilitate response and will use response metrics and learnings to influence new detections. They will enhance this process with threat intelligence and vulnerability management metrics as well.

The ideal candidate will have strong communication skills, being a hands-on engineer and will have a systemic view of the problem space focusing on solving the biggest problems and designing solutions that can scale. Experience in detection and response operations, including the investigation, triage, and management of security incidents. Exposure to incident coordination and stakeholder communication during security events is desirable. Experience with automation and forensics is highly desirable.

This position offers the opportunity to contribute to the security of hardware products with complex threat models.

Responsibilities, Duties And Expectations

Detection & Monitoring

• Develop, tune, and maintain detection rules across SIEM and security tooling
• Improve signal-to-noise ratio by reducing false positives and enhancing alert fidelity
• Leverage threat intelligence, vulnerability data, and attacker techniques to build new detections
• Investigate and respond to security incidents across endpoints, cloud, and SaaS environments
• Support incident handling from detection through containment, eradication, and recovery
• Participate in incident response rotations and follow established runbooks

Automation & Tooling

• Contribute to automation of detection and response workflows (e.g. scripts, playbooks)
• Work with security orchestration tools to improve response efficiency
• Support development and improvement of internal security tools
• Conduct post-incident reviews (RCA) and contribute to lessons learned
• Identify gaps in detection and response capabilities and propose improvements
• Maintain and improve incident response documentation and runbooks
• Work closely with engineering, IT, and security teams on investigations and improvements
• Communicate findings and incident updates clearly to stakeholders
• Contribute to building a strong security culture across the organization

Qualifications, Experience And Skills

• 3-6 years of experience in security operations, incident response, or detection engineering
• Hands-on experience investigating security incidents in cloud or enterprise environments
• Familiarity with SIEM platforms and log analysis
• Basic scripting or programming experience (Python, Bash, KQL, Go or Powershell)
• Understanding of common attack techniques, malware behaviour, and threat lifecycle
• Experience with Linux/macOS command line environments
• Knowledge of cloud platforms (AWS, Azure or similar)
• Strong analytical and problem-solving skills

Nice to Have

• Experience with detection-as-code or infrastructure-as-code
• Exposure to malware analysis or digital forensics
• Experience with automation frameworks or SOAR platforms
• Understanding of threat modelling and attacker methodologies
• Familiarity with modern security tools (EDR, IDS, cloud security tools)
• Interest in leveraging AI/LLMs for security operations

What Success Looks Like

• Effectively triaging and responding to security alerts with minimal supervision
• Contributing meaningful improvements to detection coverage and response speed
• Building automation that reduces manual workload
• Demonstrating growth toward owning incident response and detection strategy

Why This Role

• Hands-on exposure to real-world security incidents
• Opportunity to grow into a senior D&R or security engineering role
• Work in a fast-paced, high-impact security environment
• Contribute to protecting critical systems and users

Note for recruitment agencies: We do not accept unsolicited candidates from external recruiters unless specifically instructed.

Data Privacy

DroneShield Group Pty Ltd collects and processes personal information for recruitment and hiring purposes. Where applicable, personal information is processed on the basis of DroneShield's legitimate interests in assessing and selecting candidates for employment. For further information regarding how we collect, use, disclose, store and retain personal information, including your privacy rights, please refer to our Privacy Policy: https://www.droneshield.com/privacy-policy