Lead Cyber security Analyst

M&T Resources; Canberra; Hybrid; AUD 120,000 - 160,000; Full time

Benefits offered by this job

Hybrid working arrangements

Opportunity to work on high-impact CYB

Job summary

M&T Resources is seeking a Lead Cyber Threat Analyst in Canberra to drive proactive threat hunting and incident response across our enterprise environments. You will lead investigations, analyze adversary techniques and develop threat intelligence products to support risk assessments and remediation efforts.

Join a team focusing on advanced threat detection, security operations, and collaboration with stakeholders across IT and security functions.

Qualifications

• Extensive experience in cyber threat hunting and threat analysis.
• Strong incident response and cyber investigation experience.
• Expertise with Defender XDR and advanced hunting using KQL.
• Experience with SIEM platforms such as Microsoft Sentinel, QRadar, or Elastic.
• Solid understanding of threat intelligence and threat modelling.
• Experience in large enterprise or government cybersecurity environments.
• Knowledge of PSPF, ISM, Essential Eight and NIST security frameworks.
• Excellent stakeholder engagement and communication skills.

Responsibilities

• Lead proactive cyber threat hunting activities across enterprise environments.
• Investigate cyber security incidents, intrusions and suspicious activity.
• Conduct technical analysis of emerging threats, adversary behaviours, and attack patterns.
• Support and lead incident response activities, including containment, investigation and reporting.
• Develop threat intelligence products, threat models and risk assessments.
• Analyse vulnerabilities, identify security gaps and recommend remediation strategies.
• Collaborate with cyber operations, threat intelligence, engineering and security teams.
• Mentor team members and contribute to capability uplift initiatives.
• Produce high-quality reports and briefings for technical and non-technical stakeholders.

Skills

Cyber threat hunting

Threat analysis

Incident response

Cyber investigation

Microsoft Defender XDR

Advanced hunting (KQL)

SIEM experience

Threat intelligence

Threat modelling

Stakeholder engagement

Tools

Microsoft Defender XDR

KQL

Microsoft Sentinel

QRadar

Elastic

Job description

Lead Cyber Threat Analyst

Security Requirements Applicants must be Australian Citizens and able to obtain or hold an NV1 Security Clearance.

Key Responsibilities

• Lead proactive cyber threat hunting activities across enterprise environments.
• Investigate cyber security incidents, intrusions and suspicious activity.
• Conduct technical analysis of emerging threats, adversary behaviours, and attack patterns.
• Support and lead incident response activities, including containment, investigation and reporting.
• Develop threat intelligence products, threat models and risk assessments.
• Analyse vulnerabilities, identify security gaps and recommend remediation strategies.
• Collaborate with cyber operations, threat intelligence, engineering and security teams.
• Mentor team members and contribute to capability uplift initiatives.
• Produce high-quality reports and briefings for technical and non-technical stakeholders.

Essential Skills & Experience

• Extensive experience in Cyber Threat Hunting and Threat Analysis.
• Strong Incident Response and Cyber Investigation experience.
• Expertise with Microsoft Defender XDR and Advanced Hunting using KQL.
• Experience working with SIEM platforms such as Microsoft Sentinel, QRadar, or Elastic.
• Strong understanding of Threat Intelligence and Threat Modelling.
• Experience within large enterprise or government cyber security environments.
• Knowledge of PSPF, ISM, Essential Eight and NIST security frameworks.
• Excellent stakeholder engagement and communication skills.

Desirable Experience

• Malware Analysis and Reverse Engineering.
• Digital Forensics.
• Security Automation and SOAR platforms.
• Rapid7, Tenable or other vulnerability management solutions.
• Active Directory and Microsoft Entra ID.
• Azure, AWS or Google Cloud security.
• PowerShell and Python scripting.
• Identity and Access Management (IAM) technologies.

What's on Offer

• Initial 12-month contract.
• Potential extensions up to 24 months.
• Hybrid working arrangements.
• Opportunity to work on high-impact cyber security initiatives.
• Exposure to advanced threat hunting, incident response and security technologies.

Application Deadline Applications close 13 October 2026, so early applications are encouraged.