Security Operations Lead

Sharp & Carter Digital and Technology; Melbourne; Hybrid; AUD 140,000 - 190,000; Full time

Job summary

Sharp & Carter Digital and Technology is seeking an experienced Security Operations Lead in Melbourne to drive hands-on technical leadership across security operations, incident response and detection engineering. The role focuses on Microsoft Sentinel, Defender XDR and MDR services, with a strong emphasis on improving detection and incident response across a 24x7 environment.

You will mentor SOC analysts, lead Level 2/3 investigations and coordinate operational activities, reporting to the

Qualifications

• Minimum five years in cyber security or SOC operations.
• Experience as Senior SOC Analyst, L3 Analyst or technical team leader.
• Hands-on experience in incident response, threat detection and security investigations.
• Experience in 24x7 SOC or MDR environment.
• Knowledge of MITRE ATT&CK, NIST IR frameworks, ISO 27001.

Responsibilities

• Provide hands-on technical leadership across security operations and incident response activities.
• Lead complex Level 2 and Level 3 security incident investigations, escalations and response activities.
• Support delivery and continuous improvement of 24x7 MDR services.
• Develop, maintain and optimise detection capabilities across Microsoft Sentinel and Defender XDR.
• Create and refine KQL queries, detection rules and automated response workflows.
• Leverage SOAR and Azure Logic Apps to improve security operations.
• Mentor SOC analysts and coordinate operational activities.
• Identify opportunities to improve detection coverage and incident response processes.

Skills

Security leadership

Incident response

Threat detection

Mentoring analysts

Operational coordination

Education

SC-200 Certification

SC-100 Target

CISSP / GIAC / CISM (nice to have)

Tools

Microsoft Sentinel

Defender XDR

SOAR

Azure Logic Apps

KQL

Job description

Security Operations Lead
Melbourne | Hybrid | Permanent

An exciting opportunity is available for an experienced Security Operations Lead to take on a hands-on technical leadership role within a growing cyber security function.

This position offers a combination of incident response, detection engineering and security operations leadership, working extensively across Microsoft Sentinel, Defender XDR and managed detection and response services.

You'll play a key role in supporting day-to-day SOC operations, mentoring analysts and driving continuous improvement across security monitoring and incident response capabilities.

Reporting to the Security Operations Manager, you will provide technical and operational leadership across the Security Operations Centre, supporting the delivery of 24×7 managed detection and response services.

Key responsibilities include:

• Provide hands-on technical leadership across security operations and incident response activities.
• Lead complex Level 2 and Level 3 security incident investigations, escalations and response activities.
• Support the delivery and continuous improvement of 24×7 managed detection and response services.
• Develop, maintain and optimise security detection capabilities across Microsoft Sentinel and Defender XDR.
• Create and refine KQL queries, detection rules and automated response workflows.
• Leverage SOAR and Azure Logic Apps to improve security operations and incident response processes.
• Mentor SOC analysts, provide technical guidance and support operational coordination.
• Identify opportunities to improve detection coverage, incident response processes and service performance.

About You To be successful in this role, you will bring:

• A minimum of five years of experience in cyber security or SOC operations.
• Previous experience as a Senior SOC Analyst, L3 Analyst or technical team leader.
• Strong hands-on experience in incident response, threat detection and security investigations.
• Experience working within a 24×7 SOC or managed detection and response environment.
• Deep technical knowledge of Microsoft Sentinel, Defender XDR, Entra ID and Azure security.
• Strong KQL skills and experience with SOAR, automation and Logic Apps.
• Working knowledge of MITRE ATT&CK, NIST incident response frameworks, Essential Eight and ISO 27001.
• Strong communication skills and the ability to mentor analysts and coordinate operational activities.

Microsoft SC-200 certification is required, with the expectation of achieving SC-100 within three months of commencement. Additional certifications such as CISSP, GIAC or CISM will be highly regarded.