Security Operations Analyst – Cloud & Incident Response

The Onset Group; Sydney; On-site; AUD 90,000 - 130,000; Full time

Job summary

The Onset Group is seeking a Security Operations Analyst in Sydney to join a specialist team handling incident investigations across cloud platforms and SaaS. You will own investigations from alert to closure, using logs to establish what happened and determine the next steps.

Experience in Azure, AWS or GCP and proficiency with SIEM logging are essential. The role offers training and room to grow within the security function, with a four-day week pattern including a weekend day.

Qualifications

• Experience investigating incidents in a SOC or IR team.
• Experience with cloud platforms (Azure/AWS/GCP).
• Proficiency analyzing logs in a SIEM and deriving actions.

Responsibilities

• Own investigations from initial alert to closure using logs to establish what happened.
• Assess impact and determine what needs to happen next.
• Collaborate with other security teams to improve detections based on findings.

Skills

Incident investigations

SIEM analysis

Cloud platforms

Azure

AWS

GCP

Job description

Security Operations Analyst – Cloud & Incident Response

If you enjoy following an investigation through and working out what actually happened, this is worth a look.

A large global organisation is hiring two Security Operations Analysts in Sydney. You’ll join a specialist team investigating incidents across cloud platforms and SaaS applications, with colleagues across APAC, Europe and the US.

You’ll own investigations from the initial alert through to closure, using logs to establish what happened, assess the impact and determine what needs to happen next. You’ll work with other security teams when their expertise is needed, and help improve detections based on what you find.

You’re probably working in a SOC or incident response team already. Your current title matters less than the investigations you’ve personally handled. You’ll need experience investigating incidents in at least one of Azure, AWS or GCP, alongside sound technical foundations and confidence analysing logs in a SIEM.

You don’t need to know every platform or have an answer for everything. What matters is how you approach an unfamiliar problem, which questions you ask and how you use evidence to reach a conclusion.

There’s room for someone building their incident response career, as well as a more experienced analyst who enjoys the investigative work. You’ll have access to technical training and opportunities to explore other security disciplines within the organisation over time.

The working pattern needs to suit you: four fixed working days each week, including one weekend day, with longer shifts and three days off.