Lead Detection Engineer (SIEM, SOAR and Automation)

RONIN Dynamics; Sydney; Hybrid; AUD 140,000 - 230,000; Full time

Job summary

Ronin Dynamics Pty Ltd is seeking a Lead Detection Engineer to head detection engineering, security automation and telemetry health across a hybrid SOC. You will guide the senior technical voice in moving to an automated, agentic SOC and report to the SOC Manager.

You will lead rule tuning, SOAR workflow design, and ensure continuous coverage of log pipelines while collaborating with managed providers. Strong Python, API orchestration, and GCDA/GCTI/GCSA certifications are valued.

Qualifications

• Extensive cyber security experience in a large enterprise environment.
• Deep hands-on expertise across detection engineering, SOAR, SIEM and EDR.
• Experience with API integrations and log pipeline health.

Responsibilities

• Lead detection engineering and rule tuning aligned to MITRE ATT&CK.
• Design and refine SOAR workflows and automated incident response playbooks.
• Monitor, baseline and audit log pipelines to avoid blind spots.
• Build API integrations and telemetry connectors across security stack.
• Translate threat intel into proactive hunts and agentic SOC workflows.
• Act as technical quality lead for managed provider and drive detections improvements.
• Lead root cause analysis, threat modeling and post-incident improvements.

Skills

Cyber security

Detection engineering

SOAR

SIEM

EDR

Threat intelligence

Python

API orchestration

Tools

API integrations

Job description

Lead Detection Engineer (SIEM, SOAR and Automation)

| where TimeGenerated > ago(24h)

| summarize LastSeen = max(TimeGenerated) by Computer

| where LastSeen < ago(1h)

If you’ve ever run something like this and found a log source had quietly stopped talking, you already know why telemetry health matters. This team needs someone who never wants to find out the hard way.

A large Australian organisation is looking for a Lead Detection Engineer to lead detection engineering, security automation and telemetry health across its hybrid SOC. Reporting to the SOC Manager, you’ll be the senior hands‑on technical voice driving the move to an automated, agentic SOC.

What you’ll be doing

• Leading detection engineering, rule tuning and continuous mapping to MITRE ATT&CK
• Designing, building and refining SOAR workflows and automated incident response playbooks
• Monitoring, baselining and auditing log pipelines, so there are no blind spots
• Building API integrations and telemetry connectors across the security stack
• Turning threat intelligence into proactive hunts, and piloting agentic SOC workflows
• Acting as the technical quality lead for the managed provider, validating escalations and driving detection improvements
• Leading root cause analysis, threat modelling and post‑incident engineering improvements

What you’ll bring

• Extensive cyber security experience in a large enterprise environment
• Strong hands‑on experience across detection engineering, SOAR, SIEM and EDR
• Experience with API integrations, data parsing and log pipeline health
• A strong understanding of adversary TTPs and MITRE ATT&CK
• Experience working with managed security providers in a hybrid SOC
• Bonus points for Python, API orchestration or agentic security workflows, and certifications such as GCDA, GCTI or GCSA

The practical bits

• Permanent, full time
• Hybrid, Sydney