Senior Cyber Detection Engineer

LT Harper Group; Sydney; Hybrid; AUD 160,000 - 180,000; Full time

Benefits offered by this job

Hybrid work

2 days from home

Job summary

LT Harper Group in Sydney is seeking a Senior Cyber Security Engineer to own detection and response during a major transformation. You'll shape detection engineering and incident response on a modern Microsoft security stack, coordinating with an external SOC and MSPs.

The role requires 10+ years in security operations and hands-on EDR/SIEM expertise. Hybrid work, with three days in the office and two from home, is offered along with a strong salary package.

Qualifications

• 10+ years in security operations, detection engineering, incident response or cyber defence.
• Proven track record leading cyber investigations and incident response.
• Strong hands-on EDR and SIEM experience, ideally Defender for Endpoint and Sentinel.
• Solid understanding of attacker techniques, MITRE ATT&CK, malware behaviour and security telemetry, with working knowledge of Windows, Linux and network security.
• Experience working with managed security providers and SOC environments.
• Ability to explain technical issues in business language and stay calm and effective during major incidents.

Responsibilities

• Build, tune and extend detection use cases across EDR, SIEM, cloud, identity and network platforms, closing coverage gaps and onboarding new log sources.
• Lead technical investigations and response for cyber incidents, from containment through to recovery, post-incident reviews and executive reporting.
• Run proactive threat hunting and feed findings and threat intelligence back into detection logic.
• Act as the Detection & Response SME on projects, including the SAP programme, defining logging, monitoring and response requirements for new platforms.
• Lead the operational relationship with the external SOC and managed security providers, reviewing performance and validating their investigations.
• Keep runbooks, playbooks and procedures current and support audit and governance work.

Skills

EDR expertise

SIEM experience

Threat hunting

Incident response

MITRE ATT&CK knowledge

Windows/Linux/network security

SOC coordination

Communication under pressure

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

KQL

PowerShell

Python

Job description

Senior Cyber Security Engineer, Detection & Response

Sydney, hybrid

You'll take technical ownership of detection and response for a well-known manufacturer operating across Asia-Pacific, during a major business and technology transformation. It's a senior individual contributor seat on a modern Microsoft security stack, setting the direction for detection engineering, incident response and the external SOC.

The essentials

• $160,000-$180,000 + super
• Sydney, hybrid: 3 days in the office, 2 from home

What you'll actually do

• Build, tune and extend detection use cases across EDR, SIEM, cloud, identity and network platforms, closing coverage gaps and onboarding new log sources
• Lead technical investigations and response for cyber incidents, from containment through to recovery, post-incident reviews and executive reporting
• Run proactive threat hunting and feed findings and threat intelligence back into detection logic
• Act as the Detection & Response subject matter expert on projects, including the SAP programme, defining logging, monitoring and response requirements for new platforms
• Lead the operational relationship with the external SOC and managed security providers, reviewing performance and validating their investigations
• Keep runbooks, playbooks and procedures current and support audit and governance work

What you'll need

• 10+ years in security operations, detection engineering, incident response or cyber defence
• A track record of leading cyber investigations and incident response
• Strong hands‑on EDR and SIEM experience, ideally Microsoft Defender for Endpoint and Microsoft Sentinel
• Solid understanding of attacker techniques, MITRE ATT&CK, malware behaviour and security telemetry, with working knowledge of Windows, Linux and network security
• Experience working with managed security providers and SOC environments
• The ability to explain technical issues in business language and stay calm and effective during major incidents

Nice to have

• Azure and Microsoft 365 security monitoring
• Exposure to Operational Technology (OT) environments
• Scripting in KQL, PowerShell or Python
• SOAR and security automation experience

What's in it for you

• Senior ownership of detection and response through a significant transformation programme
• A modern Microsoft security stack
• Hybrid working, with 2 days a week from home