Senior Cyber Threat Analyst

Emanate Technology; Canberra; On-site; AUD 90,000 - 130,000; Full time

Job summary

The Threat Detection Engineer will join a federal government cyber team in Canberra, focusing on developing and maintaining detection content across SIEM, SOAR and EDR platforms.

You will work with cyber defence analysts and engineers in ITIL/Agile environments, tune rules, build playbooks, and uplift monitoring and response capabilities for AI misuse and data leakage. This is a contract/long-term engagement with NV1 clearance.

Responsibilities

• Develop detection use cases informed by threat models, vulnerabilities, intelligence, incident reports and industry frameworks.
• Build and maintain detection rule syntax across SIEM and EDR platforms.
• Create playbooks to support alert validation and incident response workflows.
• Maintain and enhance threat models using STRIDE, ATT&CK, attack path analysis and related methodologies.
• Assess emerging threats associated with AI platforms and develop monitoring controls for AI misuse, data leakage, prompt injection, model abuse and adversarial activity.
• Collaborate with architecture and engineering teams to translate threat modelling outcomes into monitoring and detection requirements.
• Maintain threat intelligence integrations across the SOC technology stack.
• Conduct research and analysis to develop new detection content and uplift existing rules.
• Support incident response activities under direction of the Incident Manager.
• Assist with onboarding new data sources to meet detection requirements.
• Provide feedback to improve intelligence production and reporting.
• Contribute to cyber exercises, planning activities and time-sensitive operations.

Job description

A large federal government environment is seeking an experienced Threat Detection Engineer (TDE) to join a high-performing cybersecurity team. This role is ideal for a detection-focused security professional who enjoys deep technical problem-solving, building high-fidelity detection content, and uplifting enterprise monitoring and response capabilities.

The role operates within an ITIL and Agile environment and collaborates closely with cyber defence analysts, architecture teams and engineering stakeholders across cloud and on-premises environments.

About the Role

The Threat Detection Engineer is responsible for developing and maintaining detection content, threat models, and intelligence integrations across a modern SOC technology stack. Working across SIEM, SOAR and EDR platforms, the TDE researches, engineers and tunes detection rules, builds playbooks, and ensures threat modelling outcomes translate into actionable monitoring and response controls.

Key Responsibilities

• Develop detection use cases informed by threat models, vulnerabilities, intelligence, incident reports and industry frameworks.
• Build and maintain detection rule syntax across SIEM and EDR platforms.
• Create playbooks to support alert validation and incident response workflows.
• Maintain and enhance threat models using STRIDE, ATT&CK, attack path analysis and related methodologies.
• Assess emerging threats associated with AI platforms and develop monitoring controls for AI misuse, data leakage, prompt injection, model abuse and adversarial activity.
• Collaborate with architecture and engineering teams to translate threat modelling outcomes into monitoring and detection requirements.
• Maintain threat intelligence integrations across the SOC technology stack.
• Conduct research and analysis to develop new detection content and uplift existing rules.
• Support incident response activities under direction of the Incident Manager.
• Assist with onboarding new data sources to meet detection requirements.
• Provide feedback to improve intelligence production and reporting.
• Contribute to cyber exercises, planning activities and time-sensitive operations.

Threat Detection Engineer Location: Canberra, ACT Clearance: NV1 (minimum) Engagement: Contract / Long-term opportunity

About the Environment

You will be joining a fast-paced, digitally-focused government environment undergoing significant uplift in cyber maturity, technology modernisation and security operations capability. The cyber team works across governance, operations, advisory and engagement streams, collaborating to strengthen organisational resilience and protect critical assets.

We are an inclusive employer committed to fostering a diverse and accessible workplace. We encourage applications from Aboriginal and Torres Strait Islander peoples, people with disabilities, LGBTQIA+ individuals, people of all ages, and those from culturally and linguistically diverse backgrounds.