Senior Incident Responder (Cyber Security)

Ronin Dynamics Pty Ltd; Sydney; Hybrid; AUD 160,000 - 180,000; Full time

Job summary

Ronin Dynamics Pty Ltd in Sydney is seeking a Senior Incident Responder to lead live cyber incident engagements, from detection through to recovery and post-incident review.

You will act as lead investigator across endpoints, network, identity and cloud, manage third-party providers, and drive reporting and playbook development.

The role is permanent, full-time with hybrid work in Sydney and a base salary of AUD 160k–180k plus super.

Qualifications

• Senior, hands-on incident response experience, including live P1s such as ransomware or BEC.
• Forensic and investigation skills across endpoint, memory and logs.
• Hands-on SIEM and EDR experience (Sentinel, Defender, Splunk, CrowdStrike or similar).
• Experience managing a third-party security provider, and clear views on what good reporting looks like.
• A calm head at 3am, and the ability to explain what's going on to senior leaders who aren't technical.

Responsibilities

• Lead the technical response to cyber incidents, from triage and containment through to recovery and the post-incident review.
• Act as lead investigator across endpoint, network, identity and cloud.
• Hold a managed security service provider to account on escalations, performance and monthly reporting.
• Write the playbooks and run the tabletops, so each incident goes better than the last.
• Threat hunting when things are relatively quiet.

Skills

Incident response

Forensic analysis

SIEM / EDR

Vendor management

Leadership under pressure

Tools

Sentinel

Defender

Splunk

CrowdStrike

Job description

T1486.

If your stomach just dropped a little, you've probably been in the room when it happened for real. That's exactly who we're after.

A large Australian organisation is building out its security operations team under a new SOC Manager. They need a Senior Incident Responder who has run live P1s from first alert to stand-down. Tabletops are great, but this role needs someone who has done the real thing.

What you'll be doing

• Leading the technical response to cyber incidents, from triage and containment through to recovery and the post-incident review
• Acting as lead investigator across endpoint, network, identity and cloud
• Holding a managed security service provider to account on escalations, performance and monthly reporting
• Writing the playbooks and running the tabletops, so each incident goes better than the last
• Threat hunting when things are (relatively) quiet

What you'll bring

• Senior, hands-on incident response experience, including live P1s such as ransomware or BEC
• Forensic and investigation skills across endpoint, memory and logs
• Hands-on SIEM and EDR experience (Sentinel, Defender, Splunk, CrowdStrike or similar)
• Experience managing a third-party security provider, and clear views on what good reporting looks like
• A calm head at 3am, and the ability to explain what's going on to senior leaders who aren't technical

The practical bits

• Permanent, full time
• Hybrid, Sydney
• $160k to $180k base plus super
• Reports to the SOC Manager

Walked a P1 from detection to stand-down recently? Let's talk.