Senior Cyber Operations Engineer (Contract)

Decipher Bureau; Sydney; On-site; AUD 122,000 - 203,000; Full time

Benefits offered by this job

Daily rate up to AUD 1100

Job summary

Decipher Bureau is seeking a Senior Cyber Operations Engineer for a 12-month contract in Sydney. You will own Microsoft Sentinel engineering, build and govern SOAR playbooks, and work with an MDR provider to strengthen detections across a hybrid environment.

The role demands hands-on expertise with security tooling, vulnerability reporting and edge protection, delivering outcomes as the internal SME. Sydney-based, daily rates apply.

Qualifications

• Deep hands-on Microsoft Sentinel experience including ingestion pipelines, DCRs and log tier optimisation.
• Experience building SOAR playbooks in Azure Logic Apps using REST APIs.
• Experience with or governing an MDR provider or managed SOC, including detection engineering against MITRE ATT&CK.
• Hands-on with Tenable and WAS scanning, Akamai App & API Protector or Illumio.
• Enterprise network and DNS security in hybrid environments; scripting in PowerShell or Python.

Responsibilities

• Microsoft Sentinel engineering: ingestion pipelines, Data Collection Rules and log tier optimisation to balance retention vs cost.
• SOAR automation: building Azure Logic Apps playbooks for containment and MFA triggers.
• Managed SOC/MDR governance: internal SME on escalations, refining runbooks and validating detections.

Skills

Microsoft Sentinel

SOAR

MDR

Tenable

WAS

Akamai App & API Protector

Illumio

PowerShell

Python

Tools

Azure Logic Apps

Job description

Senior Cyber Operations Engineer (Contract)

This organisation is running a dedicated cyber resilience program to uplift its security operations, and this role sits at the centre of it.

It operates a large, complex hybrid environment with a big and diverse user population, critical systems to protect and an external MDR and managed SOC already in place. What it needs now is a senior engineer on the inside who owns the technology and holds those providers to a high standard.

You will have genuine ownership: telemetry, detections, automated response, vulnerability reporting and edge protection all run through you. It's a broad role with real problems to solve, like tuning a WAF to block real attacks while letting through legitimate traffic that looks hostile at first glance.

This is a hands-on engineering role with SME authority, not an advisory or oversight position. It's a 12 month contract engaged through a statement of work.

What the role covers:

• Microsoft Sentinel engineering: ingestion pipelines, Data Collection Rules and log tier optimisation (Analytics, Basic, Auxiliary) to balance retention against cost; advanced KQL analytics and Workbooks
• SOAR automation: building Azure Logic Apps playbooks for behavioural containment, such as offshore logins followed by VPN triggering session revocation or step-up MFA
• Managed SOC and MDR governance: acting as the internal SME on escalations, refining runbooks, validating detection fidelity and killing false positives
• Vulnerability management: running Tenable and WAS scans, pre-filtering the noise and publishing CVSS, CVE and EPSS reporting to Power BI
• Edge and network security: moving Akamai WAF properties to block mode without breaking legitimate workloads, and enforcing Illumio micro-segmentation around critical systems

This organisation is running a dedicated cyber resilience program to uplift its security operations, and this role sits at the centre of it.

It operates a large, complex hybrid environment with a big and diverse user population, critical systems to protect and an external MDR and managed SOC already in place. What it needs now is a senior engineer on the inside who owns the technology and holds those providers to a high standard.

You will have genuine ownership: telemetry, detections, automated response, vulnerability reporting and edge protection all run through you. It's a broad role with real problems to solve, like tuning a WAF to block real attacks while letting through legitimate traffic that looks hostile at first glance.

This is a hands-on engineering role with SME authority, not an advisory or oversight position. It's a 12 month contract engaged through a statement of work.

What the role covers:

• Microsoft Sentinel engineering: ingestion pipelines, Data Collection Rules and log tier optimisation (Analytics, Basic, Auxiliary) to balance retention against cost; advanced KQL analytics and Workbooks
• SOAR automation: building Azure Logic Apps playbooks for behavioural containment, such as offshore logins followed by VPN triggering session revocation or step-up MFA
• Managed SOC and MDR governance: acting as the internal SME on escalations, refining runbooks, validating detection fidelity and killing false positives
• Vulnerability management: running Tenable and WAS scans, pre-filtering the noise and publishing CVSS, CVE and EPSS reporting to Power BI
• Edge and network security: moving Akamai WAF properties to block mode without breaking legitimate workloads, and enforcing Illumio micro-segmentation around critical systems

What you will bring:

• Deep, hands-on Microsoft Sentinel experience: advanced KQL, DCR configuration, ingestion tier optimisation and custom Workbooks
• SOAR playbooks you have built and deployed in Azure Logic Apps, using REST APIs
• Experience working with or governing an MDR provider or managed SOC, including detection engineering against MITRE ATT&CK
• Hands-on with Tenable and WAS scanning, Akamai App & API Protector or Illumio; the more of these the better
• Enterprise network and DNS security in hybrid environments, plus scripting in PowerShell or Python (nice to have: SC-200, SC-100, AZ-500 or CISSP)

This would suit a senior security engineer finishing a Sentinel or SOC uplift contract, or someone at an MSSP or MDR provider who wants to move client side and own the outcome.

Sydney based candidates only; background and professional suitability checks required.

For a confidential conversation, contact ******@decipherbureau.com

Additional information

• Own Microsoft Sentinel and SOAR engineering
• Up to $1100 per day - daily rates
• Oversee technical direction of managed services