Junior CSOC Threat Hunter & Incident Responder

3020 NG Australia Pty Ltd.; Canberra; On-site; AUD 70,000 - 90,000; Full time

Benefits offered by this job

Professional development

Paid annual leave 2 weeks

Novated car lease

Generous parental leave 18 weeks

Volunteer and enhanced reservist leave

Health and wellbeing program

Employee Assistance Program

Job summary

NorthGrummanAustralia is seeking an entry‑to‑mid‑level Cyber Security Operations Centre (CSOC) team member in Australia.

The role focuses on proactive, hands‑on cyber defence rather than traditional log watching, operating during standard business hours as part of a highly engaged team that defends our networks against sophisticated threat actors, with exposure to real incidents, modern tooling and ongoing capability uplift.

Qualifications

• Australian citizenship is required; no relocation assistance.
• Minimum 1 year of SOC or IT infrastructure experience.
• Solid understanding of networking and common attack techniques.
• Basic incident response concepts.
• Willing to be mentored and continue learning (home labs/CTFs).
• Ability to work autonomously and collaborate with others.

Responsibilities

• Analyze logs and alerts, conduct threat hunting, incident investigation and response.
• Contribute to the continuous improvement of our security posture.
• Uplift and fine‑tune security controls such as IPS, email gateways, EDR and SIEM tooling.
• Assist with process and technology improvements supporting the secure evolution of M365, cloud technologies and emerging capabilities.
• Work collaboratively with the CSOC team to defend enterprise networks and handle incidents in real time.

Skills

SOC experience

IT infrastructure experience

Networking

Threat techniques

Incident response concepts

Autonomy

Mentorship mindset

Tools

SIEM tooling

EDR

IPS

Email gateways

Job description

NorthGrummanAustralia is seeking an entry‑to‑mid‑level Cyber Security Operations Centre (CSOC) team member in Australia.

The role focuses on proactive, hands‑on cyber defence rather than traditional log watching, operating during standard business hours as part of a highly engaged team that defends our networks against sophisticated threat actors, with exposure to real incidents, modern tooling and ongoing capability uplift.