Hybrid Detection Engineer: SIEM Expert (Sentinel, Splunk)

Orro Pty Ltd; Sydney; Hybrid; AUD 120,000 - 165,000; Full time

Benefits offered by this job

Public holiday swaps and flexible work

Paid volunteer leave (3 days/year)

Novated leasing

Employee discounts

Wellbeing platform

Mentoring program

Job summary

Orro Pty Ltd is seeking a Detection Engineer for its Security Operations Centre. You will own detection content across Microsoft Sentinel, SentinelOne and Splunk, tune noise, and collaborate with threat hunters and SOC analysts both remotely and onsite.

The role bridges threat intel, engineering, and client-facing projects in a hybrid Australian environment. You will build detections, align to MITRE ATT&CK, and drive improvements in alert quality while maintaining strong documentation and

Qualifications

• At least 2 years of hands-on experience in detection engineering or large-scale security operations.
• Experience building detection rules in at least two of Microsoft Sentinel, SentinelOne and Splunk with reduced false positives.
• Fluency across multiple query languages and writing efficient queries over large data sets.
• Solid understanding of MITRE ATT&CK and how it maps to business risk.
• Ability to document and explain technical detail clearly to technical and non-technical audiences.

Responsibilities

• Design high-fidelity detections for subtle or evasive behaviors, balancing coverage against noise and cross-SIEM compatibility.
• Tune high-volume rules by identifying root causes of noise and improving precision.
• Translate customer risk profiles into a prioritized detection strategy.
• Audit logging against intended coverage, map to MITRE ATT&CK and business risk, and flag gaps.
• Convert threat intelligence into concrete telemetry checks mapped to ATT&CK techniques.
• Perform SIEM-based event analysis and coordinate security incidents with stakeholders.

Skills

Detection engineering

Query languages

MITRE ATT&CK

Documentation

Education

Computer science qualification (certificate/diploma/bachelor/master)

Tools

Microsoft Sentinel

SentinelOne

Splunk

Job description

Orro Pty Ltd is seeking a Detection Engineer for its Security Operations Centre. You will own detection content across Microsoft Sentinel, SentinelOne and Splunk, tune noise, and collaborate with threat hunters and SOC analysts both remotely and onsite.

The role bridges threat intel, engineering, and client-facing projects in a hybrid Australian environment. You will build detections, align to MITRE ATT&CK, and drive improvements in alert quality while maintaining strong documentation and