Security Engineer (SIEM)

Metrea; City of Brisbane; On-site; AUD 110,000 - 180,000; Full time

Benefits offered by this job

Private Health Insurance

Generous annual leave

Annual incentive plan

Paid parental leave

Life and disability insurance

Income Protection Insurance

Employee Assistance Program

Novated Car Leasing

Job summary

Metrea is seeking a Security Engineer for its Australian team to design, implement, and optimize security monitoring across a Microsoft Azure environment. You will manage the Sentinel SIEM, build use cases, and automate responses to improve threat detection and incident response.

You will work with security operations, infrastructure, and applications teams to raise visibility, reduce risk, and support audits. A strong focus on cloud-first security and MITRE ATT&CK mapping is expected.

Qualifications

• 5+ years in cyber security, security operations, or SIEM roles.

Responsibilities

• Design, implement and continuously improve security monitoring and detection in Microsoft Sentinel and Azure Log Analytics.
• Develop SIEM use cases, analytics rules, and automated response playbooks.
• Perform alert tuning to improve detection fidelity and reduce false positives.
• Conduct threat hunting using Microsoft Sentinel, KQL and threat intel.
• Investigate security events and incidents and support incident response.
• Develop dashboards, workbooks, and operational security reporting.
• Onboard new data sources to improve visibility across the estate.
• Align detections to MITRE ATT&CK techniques and threat-based frameworks.
• Collaborate with infrastructure and application teams to remediate risks.

Skills

Azure Sentinel

KQL

Threat hunting

Security operations

Incident response

SOAR

Security automation

Education

Bachelor's degree in Cyber Security or related field

Tools

Azure Log Analytics

Microsoft Defender XDR

Logic Apps

SIEM tools

Job description

Company Overview

Metrea delivers effects-as-a-service to national security partners across five domains and more than a dozen mission areas. These include airborne ISR, electronic warfare, secure communications, aerial refueling, special air missions, aerial firefighting, and advanced simulation. We own the whole stack: designing, building, and operating turnkey capabilities that give our partners decisive, asymmetric advantage against rapidly evolving threats.

Company Overview

Metrea delivers effects-as-a-service to national security partners across five domains and more than a dozen mission areas. These include airborne ISR, electronic warfare, secure communications, aerial refueling, special air missions, aerial firefighting, and advanced simulation. We own the whole stack: designing, building, and operating turnkey capabilities that give our partners decisive, asymmetric advantage against rapidly evolving threats.

Group Overview

Metrea is actively building its presence in Australia as part of a deliberate, globally coordinated expansion into the Asia-Pacific region. Our Asia-Pacific Market Group, headquartered in Brisbane with an additional office in Perth, is the enterprise's dedicated regional interface — connecting Australia's national security community with Metrea's full suite of capabilities across three core domains: Aerospace, Electromagnetic & Cyber, and Digital & Synthetic. Metrea is now bringing that same depth of mission expertise and proven operating model to Australia.

Underpinning these capabilities is a global network of Support Groups spanning people, finance, platform, operations, legal, and engagement — ensuring that as we grow in Australia, we do so with the full weight of an established global enterprise behind us.

Metrea's solutions are built for elegance: effective, efficient, and evolving — enabling our partners to scale capacity and achieve asymmetric advantage against rapidly evolving threats.

Headquartered in Washington, DC, with facilities across the United States, the United Kingdom, as well as Continental Europe and Asia-Pacific.

Position Summary

We are seeking a skilled and motivated Security Engineer to join our Australian team. This role is responsible for the design, documentation, implementation, optimisation, and ongoing management of security monitoring and detection capabilities across a classified Microsoft Azure environment.

The Security Engineer will play a key role in the administration and continuous improvement of the organisation's Microsoft Sentinel SIEM platform, Azure Log Analytics workspaces, security automation, and detection engineering capabilities. Working closely with security operations, infrastructure and application teams, the role will focus on enhancing visibility, reducing risk, improving threat detection coverage, and supporting effective incident response outcomes.

The successful candidate will be responsible for SIEM architecture and configuration, use case development, alert tuning, threat hunting, playbook automation, and the investigation of security events and incidents. They will leverage the Microsoft security ecosystem to develop and maintain effective monitoring and response capabilities aligned with evolving cyber threats and business requirements.

This position requires strong technical expertise in cloud security, security monitoring, and detection engineering, combined with a proactive approach to continuous improvement and cyber defence.

What You'll Do

Design, implement, and continuously improve security monitoring and detection capabilities within Microsoft Sentinel and Azure Log Analytics, ensuring effective visibility across the organisation's technology environment. Develop and optimise SIEM use cases, analytics rules, and automated response playbooks while investigating security events and enhancing the organisation's threat detection and incident response capabilities. Responsibilities fall into the following main areas:

• Administer, configure, and maintain Microsoft Sentinel and supporting Azure security monitoring platforms
• Design, implement, and continuously improve SIEM detection use cases and analytics rules
• Perform alert tuning and optimisation to improve detection fidelity and reduce false positives
• Develop and maintain automated response playbooks using Azure Logic Apps and Sentinel automation capabilities
• Conduct threat hunting activities using Microsoft Sentinel, KQL, and threat intelligence sources
• Investigate, analyse, and support the response to cyber security incidents and alerts
• Develop and maintain security monitoring dashboards, workbooks, and operational reporting
• Integrate and onboard new data sources to improve visibility across the technology estate
• Map detections and use cases to MITRE ATT&CK techniques and threat-based frameworks
• Collaborate with infrastructure and application teams to address identified security risks
• Identify opportunities to improve detection coverage, monitoring effectiveness, and incident response processes
• Support security audits, compliance activities, and cyber security assessments as required

What You Bring

The following key qualifications, skills, and experiences:

• 5+ years of experience in cyber security, security operations, detection engineering, or SIEM administration roles
• Demonstrated experience managing enterprise-scale SIEM platforms and security monitoring services
• Experience leading technical initiatives related to security monitoring, detection improvement, and incident response maturity
• Experience working in government, Defence, critical infrastructure, or highly regulated environments
• Experience supporting and authorising systems operating at PROTECTED, or higher security classifications is highly desirable
• Demonstrated experience applying ISM and PSPF requirements within operational environments
• Advanced knowledge of Azure Log Analytics, Kusto Query Language (KQL), and data ingestion architecture
• Experience designing, implementing, and maintaining SIEM use cases, analytics rules, workbooks, watchlists, and data connectors
• Proven ability to analyse complex security events and translate findings into actionable improvements
• Familiarity with Microsoft security technologies including:
• Microsoft Defender XDR
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Cloud
• Microsoft Entra ID (Azure AD)
• Experience working within cloud-first or hybrid enterprise environments
• Experience onboarding and integrating log sources from cloud, infrastructure, network, and third-party security platforms
• Strong understanding of cyber security monitoring, threat detection, incident response, and security operations practices
• Knowledge of common attack frameworks such as MITRE ATT&CK and their application to detection and threat hunting activities
• Understanding of security automation, orchestration, and response (SOAR) principles
• Experience creating dashboards, workbooks, reporting, and operational metrics for security monitoring and compliance

Additional Eligibility Qualifications

• Bachelor or higher degree in Cyber Security, Information Technology, Computer Science, Information Systems, Engineering, or relevant industry experience

Benefits

• Private Health Insurance
• Generous annual leave
• Annual incentive plan
• Paid parental leave
• Life and disability insurance
• Income Protection Insurance
• Employee Assistance Program
• Novated Car Leasing

Work Authorisation / Security Clearance

Ability to obtain and maintain an AGSVA Security Clearance.

Inclusion Statement

We are committed to building a team that reflects a broad range of backgrounds, experiences and perspectives. We welcome applications from all qualified candidates and make hiring decisions based on capability, potential and alignment with our values. If you require any adjustments throughout the recruitment process, please let us know.

Our Firmware

At Metrea, our single core value is Rooted in Humility, and our four cornerstone attributes are Entrepreneurial, Systematic, Discriminant, and Over-Deliver. These form what we call our Teammate Firmware. Just like technical firmware connects software and hardware, our Firmware is the constant interface between our mission and our people. It defines how we show up, how we work together, and how we solve complex problems.

Our team Firmware creates a web-like, hyper-collaborative, dynamically hierarchical way of working that helps us adapt quickly, communicate openly, and distribute decision-making to where expertise actually lives. It enables groups to self-organize around hard problems, shift fluidly as priorities evolve, and operate with the trust, curiosity, and discipline required in a complex mission space. This foundation allows us to deliver elegant, effective solutions and uphold our purpose: protecting our precious inheritance.