Security Operations Lead

Geelong Careers; Geelong; On-site; AUD 150,000 - 190,000; Full time

Job summary

Geelong Careers is seeking an experienced Security Operations Lead to establish and scale a new security capability within a complex Azure environment. You will shape processes, governance, and operating models across internal teams and partners.

The role combines hands-on security engineering with leadership, incident management, and metrics development. You will drive adoption of Microsoft Sentinel, Defender, Purview and Azure security services while coordinating cyber resilience initiatives.

Qualifications

• Experience leading security operations, cyber defence, or SOC functions.
• Proven track record maturing a security operations capability.
• Hands-on knowledge of Microsoft Sentinel, Defender, Purview and Azure security services.
• Experience supporting cloud transformation within a complex enterprise environment.
• Practical experience leading cyber incident management, escalation and operational recovery.
• Strong monitoring, threat detection, alert triage and security processes.
• Ability to coordinate across internal teams, cloud engineers, architects, managed service providers and delivery partners.
• Excellent communication and translating technical matters to business outcomes.
• Knowledge of risk-based decision-making in changing environments.
• Experience in regulated environments is advantageous.

Responsibilities

• Design and implement security operations processes, procedures and governance.
• Define operating model across internal teams, delivery partners and providers.
• Lead the implementation and operational adoption of SOC capabilities.
• Establish security monitoring, alert management, triage and incident response processes.
• Drive the operational use of Microsoft Sentinel, Defender, Purview and Azure security services.
• Lead cyber incident coordination, escalation, response and recovery activities.
• Support the secure transition of cloud and platform services into production.
• Develop operational metrics, dashboards, playbooks and handover documentation.
• Identify capability gaps and recommend improvements to strengthen cyber resilience.

Skills

Security operations leadership

Incident response

Cyber resilience

SOC functions

Microsoft Sentinel

Azure security services

Threat detection

Monitoring & alert triage

Stakeholder coordination

Communication skills

Risk-based decision making

Tools

Microsoft Sentinel

Microsoft Defender

Azure Purview

Azure Security Center

Job description

Job Description

This is a hands-on leadership opportunity for an experienced cyber security professional to establish and shape a new security capability within a complex Azure environment. As the Security Operations Lead, you will establish and lead the organisation's initial security operations capability supporting its new Azure environment and associated services. You will:

• Design and implement security operations processes, procedures and governance.
• Define the operating model across internal teams, delivery partners and managed service providers.
• Lead the implementation and operational adoption of Security Operations Centre capabilities.
• Establish security monitoring, alert management, triage and incident response processes.
• Drive the operational use of Microsoft Sentinel, Defender, Purview and Azure security services.
• Lead cyber incident coordination, escalation, response and recovery activities.
• Support the secure transition of cloud and platform services into production.
• Develop operational metrics, dashboards, playbooks and handover documentation.
• Identify capability gaps and recommend practical improvements to strengthen cyber resilience.

About The Candidate

• Strong experience leading security operations, cyber defence, incident response, cyber resilience or Security Operations Centre functions.
• Proven experience establishing or maturing a security operations capability.
• Hands-on knowledge of Microsoft Sentinel, Defender, Purview and Azure security services.
• Experience supporting cloud transformation, platform transition or major technology change within a complex enterprise environment.
• Practical experience leading cyber incident management, escalation and operational recovery.
• Strong knowledge of security monitoring, threat detection, alert triage and operational security processes.
• The ability to coordinate and influence internal teams, cloud engineers, architects, managed service providers and delivery partners.
• Strong communication skills with the ability to translate complex technical matters into practical business outcomes.
• Sound risk-based decision-making skills in changing and ambiguous environments.
• Experience in government, insurance or another highly regulated environment will be highly regarded. Relevant security certifications and knowledge of the Victorian Protective Data Security Framework and Essential Eight would also be advantageous.