Lead Cyber Threat Analyst

IT Alliance Australia; Canberra; On-site; AUD 120,000 - 160,000; Full time

Job summary

IT Alliance Australia in Canberra seeks a Lead Cyber Threat Analyst on a 12-month contract to strengthen the agency’s cyber posture. The role focuses on proactive threat hunting, intrusion investigations and incident response, reporting on threat modelling and intelligence.

Citizenship and holding Negative Vetting Level 1 clearance are mandatory. The Senior role requires malware analysis, AI engineering awareness, and collaboration across cyber teams to deliver actionable findings.

Qualifications

• Experience in proactive threat hunting and incident response.
• Ability to translate findings into threat models and reports.
• Experience mentoring staff in cyber defense.

Responsibilities

• Lead proactive threat hunting, intrusion investigations and incident response.
• Investigate suspicious activity, malicious domains, network traffic and endpoint threats.
• Develop threat models, hunt hypotheses and actionable intelligence reports.
• Analyse vulnerabilities, security risks and recommend remediation.
• Develop detection rules, automated playbooks and security workflows.
• Collaborate with cyber teams, engage stakeholders and mentor junior staff.

Skills

Threat hunting

Incident response

Threat modelling

Digital forensics

Mentoring

Tools

Microsoft Defender XDR

Elastic/Kibana

ExtraHop

Linux

Threat Intelligence

SIEM/EDR

Job description

One of our Federal government clients seeking to engage multiple Lead Cyber Threat Analyst in Canberra.

Location of work: Canberra

Length of contract: 12 months

Security clearance: Must be an Australian citizen and holding Negative Vetting Level 1 security clearance

Job details

Cyber Threat Analysts need to understand cyber intrusion activities then use their research skills to provide reporting on threat modelling and intelligence.

The Senior Cyber Threat Analyst with cyber threat hunting, malware analysis, AI engineering and incident response skillset and expertise who will be responsible for understanding cyber intrusion activities and applying technical analysis, research and investigative methods to identify, assess and report on malicious or suspicious activity affecting the agency. The role supports proactive threat hunting, incident response, and intelligence-informed analysis to strengthen the agency’s cyber defensive posture.

Key duties and responsibilities

• Conduct proactive cyber hunt activities based on hypotheses, intelligence reporting, anomalous activity and identified risks.
• Investigate cyber intrusion activity and suspicious behaviour across networks, systems and data sources.
• Support incident response activities through technical triage, investigation, containment support and reporting.
• Research adversary tactics, techniques and procedures and translate findings into threat modelling and actionable reporting.
• Work closely with threat intelligence, detection, vulnerability management and other cyber teams to improve investigative outcomes and defensive uplift.
• Document investigative findings, methods, artefacts and recommendations in a clear and defensible manner.
• Contribute to knowledge transfer, mentoring and capability uplift of APS staff within the Hunt and Incident Response function.
• Ability to work across multiple cyber disciplines and contribute to technically complex operational outcomes.
• Manage intrusion and analysis work with the ability to make decisions on appropriate response and escalated as necessary.
• Manage complex threat intelligence/modelling tasks and/or threat assessments.
• Manage major Information Security incidents.
• Assist with corporate response to an Information Security incident.
• Identifies and implements improved controls to reflect changes in factors such as threat levels and legislation.
• Undertake advanced research into vulnerabilities or cryptography, including producing complex exploits, undertake effective reverse engineering and/or effectively researched mitigation bypasses.
• Analyse security risks, identify control deficiencies, develop remediation strategies and implement security engineering solutions within large and complex ICT environments.

Mandatory Skills

Key Responsibilities

• Lead proactive threat hunting, intrusion investigations and incident response.
• Investigate suspicious activity, malicious domains, network traffic and endpoint threats.
• Develop threat models, hunt hypotheses and actionable intelligence reports.
• Analyse vulnerabilities, security risks and recommend remediation.
• Develop detection rules, automated playbooks and security workflows.
• Collaborate with cyber teams, engage stakeholders and mentor junior staff.

Essential Technical Skills

• Microsoft Defender XDR: Advanced Hunting using KQL, investigation of endpoint, network and email events.
• Elastic / Kibana: Log analysis using KQL, Lucene or ES|QL.
• ExtraHop: Network traffic analysis and malicious IP/domain investigations.
• Linux: Log investigation, Windows event logs and firewall logs.
• Threat Intelligence: DNS investigations, threat indicators and adversary TTP analysis.
• Strong experience in SIEM/EDR, incident response, digital forensics and cyber threat hunting.
• Understanding of PSPF, ISM, Essential Eight and NIST.

Highly Desirable

• Microsoft Sentinel, QRadar, SOAR, Rapid7, Tenable.
• Malware analysis and reverse engineering tools (FlareVM, HxD, PEStudio, Sysinternals).
• Python/PowerShell scripting and security automation.
• Azure, AWS, GCP, Active Directory, Entra ID and IAM.
• Experience integrating security tools and developing automated detection/response playbooks.
• CREST certifications or relevant cyber security qualifications.