Senior Cloud Security Analyst (SOC & Incident Response) x 2

Decipher Bureau; Sydney; Hybrid; AUD 153,000 - 187,000; Full time

Benefits offered by this job

4-day week

Hybrid after 6 months

Sydney CBD office

Job summary

Decipher Bureau is seeking a hands-on Cloud Security Analyst to investigate real international attacks across AWS, Azure, GCP and SaaS for a global bank, from alert through closure.

You’ll own incidents, dig through logs, and explain findings to stakeholders. The team is global, with a Sydney CBD office and a hybrid setup after six months, reporting to a Singapore-based hiring manager.

Qualifications

• 2 to 7 years as an analyst in a SOC or security operations role.
• Hands-on incident response in at least one of Azure, AWS or GCP.
• Experience working incidents end to end without supervision.
• Log analysis in a SIEM such as Splunk or Elastic.
• Incident response across two or more of Azure, AWS and GCP, plus SaaS.
• Alert tuning in a cloud environment. Scripting or programming experience.
• A large enterprise or banking background.

Responsibilities

• Investigate alerts and incidents from triage through to closure, running them yourself.
• Work cases ranging from brute-force attempts and suspicious AI use to data exfiltration and CVE exploitation.
• Pull and analyse logs in Splunk and Azure Log Analytics across all three clouds and SaaS.
• Spot unfamiliar data mid-incident and work out whether it matters. Tune existing detections and build new ones.

Skills

SOC experience

Incident response

Cloud security

Log analysis

Scripting

Tools

Splunk

Elastic

Azure Log Analytics

Job description

Investigate real international attacks across AWS, Azure, GCP and SaaS for a global bank, from the first alert through to closure.

• Permanent | Sydney CBD | Up to $170K + super | Hybrid after first 6 Months
• Two permanent seats at AVP level, one suited to someone ready to lead others.
• 4-day week!

Prefer working the case over building the tooling? This is a hands‑on analyst role in a global cloud security operations team. You’ll own incidents yourself, dig through the logs, and explain what happened to the people who need to know.

What’s on offer

• Up to $170K + super
• 4-day week, three days off
• A cloud security operations team spread across Australia, Singapore, the US and Europe
• A Sydney CBD office alongside around 40 people in the Sydney cyber team

The team and the work

The cloud security operations team identifies, investigates and responds to threats across the bank’s Azure, AWS, GCP and SaaS environments. You’ll report to a hiring manager in Singapore and work with 4 analysts there and 4 in Sydney.

Day to day, you’ll:

• Investigate alerts and incidents from triage through to closure, running them yourself
• Work cases ranging from brute-force attempts and suspicious AI use to data exfiltration and CVE exploitation
• Pull and analyse logs in Splunk and Azure Log Analytics across all three clouds and SaaS
• Spot unfamiliar data mid-incident and work out whether it matters. Tune existing detections and build new ones

What you must-have:

• 2 to 7 years as an analyst in a SOC or security operations role. This is an analyst role, not engineering
• Hands‑on incident response in at least one of Azure, AWS or GCP
• Experience working incidents end to end without supervision
• Log analysis in a SIEM such as Splunk or Elastic
• Incident response across two or more of Azure, AWS and GCP, plus SaaS (AWS and Azure together is ideal)
• Alert tuning in a cloud environment. Scripting or programming experience
• A large enterprise or banking background

About Decipher Bureau

Decipher Bureau is Australia’s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don’t just match skills to a job description. We take the time to understand both the technical requirements of a role and the team environment, so every introduction we make is a considered one.