Lead Spec Cyber Detect & Response CT/OT

Transport for NSW; Sydney; On-site; AUD 180,000 - 240,000; Full time

Job summary

Transport for NSW is seeking a senior cyber security leader to govern detection, incident response, and threat hunting across IT and OT, defending critical infrastructure. You will mentor a high-performing team and ensure rapid, coordinated responses to incidents in a complex environment.

The role requires hands-on security experience, strong communication with stakeholders, and a baseline security clearance. This is a senior, trusted advisory position based in Sydney.

Qualifications

• Extensive experience in cyber defense, incident response and threat detection across IT and OT.
• Hands-on use of cyber tools and threat hunting techniques.
• CISSP/CISM or equivalent certifications highly regarded.
• Able to mentor teams and influence stakeholders.
• Australian citizenship and baseline security clearance required.

Responsibilities

• Lead cyber detection and incident response across IT and OT environments.
• Oversee end-to-end cyber incident management including detection, triage, containment and recovery.
• Drive advanced threat detection and threat hunting leveraging telemetry and threat intel.
• Continuously improve playbooks, automation, use cases and defence capabilities.
• Lead day-to-day security operations ensuring alignment with government standards.
• Mentor a high-performing team and support out-of-hours incidents.

Skills

Cyber security leadership

Incident response

Threat detection

Threat hunting

Mentoring teams

Stakeholder communication

Education

CISSP or CISM certification

Job description

Organisation/Entity: Transport For NSW

Job category: Information & Communication Technology

Job location: Macquarie Park, NSW, AU, 2113

Job reference number: 108055

Employment type: Permanent Full-Time

Salary range: An attractive remuneration package

About the role

You're open to a change of direction and a new challenge. You bring structure, mitigation and education to our organisation. Our records and datasets are vast and varied. This is your opportunity to safeguard critical infrastructure, order and protect sensitive data, and defend against emerging cyber threats. You'll be part of an expert team who protect against thousands of threats every day.

In this role

• Lead the Cyber Detection and Incident Response capability, overseeing end to end cyber incident management including detection, triage, containment, eradication, recovery, and post incident review across both IT and OT environments.
• You will ensure a strong, coordinated response to Cyber incidents across a complex, critical infrastructure landscape.
• You will drive advanced threat detection and threat hunting strategies, leveraging telemetry, tools, and threat intelligence to proactively identify and reduce cyber risk.
• This includes continuously improving playbooks, automation, use cases, and overall cyber defence capabilities.
• You will lead day to day cyber security operations, ensuring alignment with government standards and regulatory requirements, while balancing incident response with longer term capability uplift.
• The role includes mentoring a high performing team and supporting ad hoc, out of hours response requirements for critical incidents.

For more information on this position and business unit, view the role description and information pack.

About You

You are a highly experienced cyber security leader with deep expertise in cyber defense, incident response, and threat detection across both IT and OT environments. You bring strong hands on experience with cyber tools, threat hunting, and incident response frameworks, with the ability to respond to evolving threats and uplift organisational security posture. Relevant certifications such as CISSP, CISM, or equivalent are highly regarded. You are an effective people leader and trusted advisor, with the ability to mentor teams, influence stakeholders, and communicate complex technical issues clearly while operating in high pressure, fast moving environments. This is a Position of Trust and will require the successful applicant to hold Australian citizenship and to obtain and maintain a BASELINE Commonwealth security clearance under the Australian Government Protective Security Policy Framework.

Work Location

This role must be based from the advertised location.

Who We Are

Transport for NSW provides a safe, integrated, and efficient transport system. We connect people, communities and industry every day.

Join us

Our workforce is as diverse as the community we serve. If you'd like further information on our inclusion and diversity initiatives, visit Transport careers. Flexible work options may be available. Learn more via Flexible work options and policy

For more information about this role, please contact [e-mail].

Aboriginal people and people living with disability are supported throughout the recruitment process and at work, and we encourage you to apply. Visit Supporting Aboriginal People or Supporting People with Disability for more information or speak to your talent team member to arrange any adjustments to how you interact with us.

Job Segment: Cyber Security, Military Intelligence, Security Clearance, Developer, Law, Security, Government, Technology, Legal