Security Operations Engineer/ Analyst

Talent; Canberra; Hybrid; AUD 110,000 - 140,000; Full time

Job summary

Talent Canberra is seeking a hands-on Security Operations Engineer to actively detect, investigate and respond to threats across cloud and enterprise environments, with a focus on practical defense and rapid containment.

You will build and tune detections in Microsoft Sentinel and Defender, conduct threat hunting, perform triage from alert through containment and recovery, and develop automation to speed responses.

Qualifications

• Hands-on cyber security operations experience in enterprise or government environments.
• Strong SIEM/SOAR capability, preferably Microsoft Sentinel.
• Experience with security automation and scripting; cloud security monitoring across Azure.

Responsibilities

• Develop and tune monitoring, analytics rules, dashboards, and detection use cases.
• Conduct proactive threat hunting and investigate security events from triage to containment.
• Build automation playbooks and scripts to improve response times and remediation.
• Collaborate with DevOps and security teams to strengthen detection coverage.

Skills

Hands-on security operations

Threat hunting

Incident response

Monitoring and detection

Security tooling automation

Tools

Microsoft Sentinel

Microsoft Defender

KQL

Microsoft Azure

Job description

Security Operations Engineer / Specialist | Security Operations, Detection Engineering & Incident Response

• Location: ACT (Hybrid)
• Security Clearance: NV1 Cleared (Mandatory)
• Contract Length: 12 Months + 2 x 12 Month Extensions (Based on the discretion of the Department)

About The Position

This is a hands‑on cyber security role.

The focus is on actively finding, understanding and responding to threats, while continuously improving how they are detected in the first place.

Working across cloud-hosted and enterprise environments, you’ll use platforms such as Microsoft Sentinel and Defender to investigate security events, develop and tune detection use cases, conduct threat hunting and support incident response. You’ll also work closely with development, DevOps and security teams so operational learnings can feed back into system design and security controls.

The distinction here is important. This isn’t primarily a coordination or operational management position. The requirement is for someone who remains technically hands‑on across detection engineering, investigation, response and security tooling.

What You’ll Do

• Develop and tune security monitoring, analytics rules, dashboards and detection use cases across SIEM/SOAR platforms.
• Conduct proactive threat hunting and investigate security events from initial triage through containment, eradication, recovery and root cause analysis.
• Build automation playbooks and scripts that improve response times, while supporting vulnerability management and remediation activities.
• Work with DevOps, development and security teams to strengthen detection coverage, security controls and operational resilience.

What We Are Looking For

• Strong hands‑on cyber security operations experience across monitoring, threat analysis, investigation and incident response in enterprise or cloud environments.
• Practical SIEM/SOAR capability, preferably Microsoft Sentinel, including KQL queries, analytics rules, alert tuning and dashboards.
• Experience with security automation and scripting, together with cloud security monitoring and controls, preferably across Microsoft Azure.
• Understanding of government cyber security frameworks and practices, including the ISM and Essential Eight.

Technology & Environment

• Microsoft Sentinel & Microsoft Defender
• KQL, SIEM/SOAR & Security Automation
• Microsoft Azure, Cloud Security & DevOps
• Threat Hunting, Incident Response & Vulnerability Management

A Quick Note Before You Apply

This role is unlikely to suit candidates whose recent experience has moved primarily into cyber coordination, governance or management without continued hands‑on involvement in security operations.

The environment calls for someone comfortable getting into the detail: investigating alerts, querying telemetry, developing detections, hunting for threats and improving the tooling and controls around them.

Applicants must be Australian Citizens and hold a minimum NV1 Security Clearance.