El1 Lead Cyber Operations Security Expert

Softtest Pays Pty Ltd; Canberra; On-site; AUD 120,000 - 150,000; Full time

Job summary

The National Disability Insurance Agency (NDIA) is seeking an EL1 Cyber Operations Security Expert in Canberra to lead and perform advanced cyber security tasks under the Director of Cyber Security Operations.

You will specialize in cloud security (Azure/AWS), endpoint and network security, threat intelligence and hunting, DLP, vulnerability management, and incident response, protecting systems and data in pursuit of NDIA's objectives.

Qualifications

• Experience in cyber security operations within a large agency or equivalent environment.
• Ability to lead security incident investigations and forensics with strong documentation.

Responsibilities

• Lead proactive monitoring, investigation, and mitigation of security incidents within security tools (Splunk, Defender 365, Azure Security Center).
• Analyze security event data and identify suspicious/malicious activity across networks and systems.
• Lead incident response activities including investigation, forensics, and chain of custody considerations.
• Respond to events using established SOPs to ensure consistent handling.
• Act as escalation point for complex incidents and SME in cloud security, active defence, and threat mitigation.
• Develop and manage phishing simulations.
• Research new threats and vulnerabilities affecting the Agency's threat landscape.
• Perform log analysis and create visualisation/reporting in Splunk.
• Identify critical data sources for SIEM ingestion and normalisation.
• Collaborate with Security Operations and IT to implement security controls.
• Supervise and mentor junior staff and drive process/tool improvements.
• Produce incident response reports, activity reports, and threat briefs.

Skills

Cloud security

Azure/AWS

Endpoint security

Network security

Threat hunting

Threat intelligence

Data loss prevention

Vulnerability management

Incident response

Security monitoring

SOPs

Tools

Splunk

Azure Security Center

Microsoft Defender 365

Job description

Australian Citizens residing in Australia only respond.

Job details

Role/s: 1 x EL1 Cyber Operations Security Expert

The Cyber Operations Security Expert, will undertake technical cyber security activities under the leadership of the Director of Cyber Security Operations. The Cyber Operations Security Expert, must possess and demonstrate technical competency in areas of cloud security (Azure/AWS), endpoint and network security, threat intelligence and hunting, data loss prevention, vulnerability management, and incident response. The Cyber Operations Security Expert, will be required to support and contribute to the protection of the Agency's systems, users, and data, to support NDIA's objectives to build a world-leading National Disability Insurance Scheme.

As part of the Cyber Security Operations team, the role will help ensure that NDIA has the capability to build and protect cyber-resilient information technology platforms and support strategic objectives.

Key duties and responsibilities

The role will involve the key responsibilities:

• Lead proactive monitoring, investigation, and mitigation of security incidents within security tools (including Sentinel, Microsoft Defender 365 stack, Azure Security Centre, Splunk)
• Analyse security event data and identifying suspicious/malicious activity from networks and systems
• Lead incident response activities including initial and detailed investigation, computer forensics, chain of custody implications
• Respond to events and incidents using established Standard Operating Procedures (SOPs)
• Be a point of escalation for complex incidents and act as a subject matter expert in areas of cloud security, active defence, and threat mitigation
• Develop and manage phishing simulations
• Research new and evolving threats and vulnerabilities to the Agency's threat landscape
• Conduct log analysis and develop visualisation and reporting within Splunk
• Identify critical data sources required by cyber for ingestion and normalisation into the SIEMs
• Collaborate with Security Operations and IT engineers to implement security controls
• Supervise, mentor and develop junior staff, and identify areas of people, process, and defensive tool improvement
• Produce and disseminate incident response reports, activity reports, and intelligence and threat briefs