Security Detection & Response Analyst roles

Morgan McKinley; Sydney; On-site; AUD 90,000 - 130,000; Full time

Job summary

Morgan McKinley is seeking Security Detection and Response Analysts (Level 1 and Level 2) for a large financial services organisation with onsite work four days a week in Sydney.

Roles involve threat detection engineering, incident investigation, SOAR automation, and continuous improvement with stakeholder communication. The position requires collaboration with security teams and mentorship of junior staff in a dynamic environment.

Qualifications

• Build, tune, and optimize detection logic mapped to MITRE ATT&CK.
• Analyze logs and telemetry to determine attack scope and root causes.
• Maintain and improve SOAR workflows and AI enhancements.
• Document incident findings and deliver stakeholder updates.

Responsibilities

• Threat detection: build and tune detection logic mapped to MITRE ATT&CK to maximize coverage.
• Incident investigation: analyze logs to determine scope and containment during active events.
• Automation: maintain SOAR workflows and AI enhancements to reduce manual effort.
• Documentation: document findings, timelines, and post-incident lessons for stakeholders.
• Mentorship: guide junior team members toward development goals.

Skills

Threat detection design

MITRE ATT&CK mapping

SOAR automation

Incident investigation

Stakeholder communication

Tools

SOAR platforms

Job description

There are multiple Security Detection and Response Analyst roles (Level 1 and Level 2) available with a large financial services organisation.

These roles have onsite requirement for 4 days.

Responsibilities:

• Threat Detection & Engineering: Build, tune, and optimize high-quality detection logic mapped to the MITRE ATT&CK framework to maximize coverage and minimize false positives.

• Incident Investigation & Response: Analyze logs and telemetry to determine attack scope and root causes, while executing containment, isolation, and remediation during active security events.

• Automation & Metrics Optimization: Maintain and improve SOAR workflows, automated playbooks, and AI enhancements to reduce manual effort and measurably improve MTTR and signal-to-noise ratios.

• Documentation & Stakeholder Communication: Document security incident findings, construct timelines, deliver clear updates to stakeholders, and conduct post-incident reviews to capture lessons learned.

• Continuous Improvement & Mentorship: Identify monitoring gaps to drive operational maturity, integrate partner use cases, and guide junior team members toward their professional development goals.

Requirements:

• Build, tune, and optimize high-quality detection logic mapped to the MITRE ATT&CK framework to maximize coverage and minimize false positives.

• Analyze logs and telemetry to determine attack scope and root causes, while executing containment, isolation, and remediation during active security events.

• Maintain and improve SOAR workflows, automated playbooks, and AI enhancements to reduce manual effort and measurably improve MTTR and signal-to-noise ratios.

• Document security incident findings, construct timelines, deliver clear updates to stakeholders, and conduct post-incident reviews to capture lessons learned.