Principal Security Operations Center Analyst

Huntress Labs; Australia; Remote; AUD 180,000 - 215,000; Full time

Benefits offered by this job

Fully remote work

Annual US trip for Summer Summit

Home office setup reimbursement

12 weeks parental leave

Digital allowance for phone/internet

Home office tech stipend

Private health insurance

Stock options

BetterUp coaching access

Job summary

Huntress Labs in Australia is seeking a Principal SOC Analyst to lead complex intrusions and drive durable detection across the APAC SOC floor. This remote-friendly role focuses on ownership of the hardest cases, collaboration with Product and Detection Engineering, and publishing research through Huntress channels.

You will mentor analysts, shape investigation standards, and advance automation while maintaining the cultural ethos of a high-ownership, low-ego team.

Qualifications

• 6+ years in SOC, IR, DFIR or MDR with multi-host intrusion leadership
• Deep knowledge of attacker tradecraft across MITRE ATT&CK and detection
• Strong malware analysis, forensics and investigation experience across Windows, macOS and Linux
• Experience in cloud identity investigation and remediation in Microsoft 365/Entra ID and Google Workspace
• Hands-on AI skills for analysis and automation with Python/PowerShell
• Proven technical leadership, mentoring and ability to set investigation standards
• Strong written and verbal communication for technical and non-technical audiences

Responsibilities

• Own complex intrusions end to end, triage to remediation across endpoints and identity systems
• Partner with Product Research and DE&TH to convert pain points into lasting detections and fixes
• Publish findings through Huntress blogs, webinars and talks
• Design and maintain automation and agentic workflows with cross-functional teams
• Oversee floor quality, QC/QA and high-impact incident reporting
• Lead and mentor teammates, run case reviews and knowledge sessions
• Model a collaborative, high-ownership culture and represent SOC in hiring decisions

Skills

SOC/IR/DFIR leadership

MITRE ATT&CK knowledge

Malware analysis

Cloud identity investigation

AI tool usage (Claude, Codex)

Windows administration

Networking fundamentals

Leadership and mentoring

Technical writing and communication

Tools

Claude

Codex

Python

PowerShell

Job description

Principal Security Operations Center Analyst

Australia

What We Do:

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That's why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

Reports to: Manager, Security Operations Center

Location: Remote Australia

Compensation Range: $180,000 to $215,000 AUD base plus bonus and equity.

What You'll Do:

As our Principal SOC Analyst in Australia, you're the most senior technical voice on the APAC SOC floor, working Monday to Friday. You'll take ownership of the hardest intrusions, turn what the floor sees every day into durable detection and product improvements, and raise the bar for every analyst around you. You'll lead by example as a cultural driver for the team, and you'll help build our Human Led Agentic SOC, where agents handle volume and humans own quality. You'll work closely with Product, Product Research and Detection Engineering & Threat Hunting. We'll also support you in publishing your research through Huntress blogs, webinars and conference talks.

Responsibilities:

• Own complex, multi-host intrusions end to end, from triage through forensic timelining, root cause and remediation, across endpoint, identity (Microsoft 365 / Google Workspace) and SIEM telemetry
• Act as the SOC's technical partner to Product, Product Research and DE&TH: turn recurring floor pain points into lasting detection, suppression and product fixes rather than workarounds
• Perform advanced static and dynamic malware analysis, research emerging tradecraft, and publish findings through Huntress content
• Find repeatable investigation patterns and toil, then design, build and maintain both automation and human-led agentic workflows with Workflow Engine owners, Product and Engineering, with inline QC/QA built in from the start
• Own quality on the floor: grade AI agent and analyst output, trace misses to their root cause and fix them at the source, and act as final technical reviewer on detection tuning, suppression decisions and high-impact incident reports
• Provide technical leadership and mentoring across every level of the team: set investigation standards, run case reviews, ride-alongs and knowledge sessions, advise the Senior Manager on SOC direction, and help assess candidates in the hiring process
• Be a cultural driver for the team: model Give a $hit, Warrior Spirit and Outcome-Obsessed, keep a low-ego, share-everything team culture, and champion the "agents handle volume, humans own quality" mindset
• Handle threat-related escalations from SOC Support, writing clear explanations of complex activity and its business risk for technical and non-technical audiences

What You Bring To The Team:

• 6+ years in SOC, Incident Response, DFIR or MDR roles, including leading multi-host intrusion investigations
• Deep knowledge of attacker tradecraft across MITRE ATT&CK (credential access, lateral movement, persistence, defense evasion, living-off-the-land) and how to detect it
• Deep forensic and investigation experience across Windows, macOS and Linux
• Strong cloud identity investigation and remediation experience in Microsoft 365 / Entra ID and Google Workspace
• Advanced static and dynamic malware analysis, including extracting IOCs and determining capability and intent
• Strong enterprise Windows administration (Active Directory, Group Policy, PowerShell, domain trusts) and core networking knowledge
• Strong hands-on AI skills: daily use of tools such as Claude and Codex for analysis, research and building automation and agentic workflows (Python, PowerShell or similar), with sound judgment about validating their output
• Understanding of inline quality delivery: building QC/QA into workflows as they run (quality gates, statistical sampling, drift detection and regression testing) rather than relying on after-the-fact review
• Proven technical leadership and mentoring: you've raised the standard of a team, not just your own work, and you explain complex findings clearly in writing and verbally

Preferred Qualifications:

• Published research, blogs, conference talks or open-source security tooling
• Detection engineering experience: writing and tuning detections and SIEM queries
• Investigations in other cloud platforms such as Azure, AWS or GCP
• Previous MSP/MSSP/MDR experience and familiarity with RMM tools

What We Offer:

• Fully remote work
• At least one annual trip to the US for Summer Summit, with additional local events in Australia!
• New starter home office set up reimbursement ($800 AUD)
• 12 weeks paid parental leave for both primary and secondary carers
• Monthly digital allowance for personal phone and internet costs ($185 AUD)
• Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)
• Subsidised private health insurance through our preferred provider
• Stock options for all full-time employees
• Access to the BetterUp platform for coaching, personal, and professional growth

People from all culturally diverse backgrounds, including Aboriginal & Torres Strait Islander Peoples, are encouraged to apply.

Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.

We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.

We do discriminate against hackers who try to exploit businesses of all sizes.

Accommodations:

If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [e-mail]. Please note that non-accommodation requests to this inbox will not receive a response.

Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights.