Senior Security Operations Specialist

GoSourcing; Queensland; Hybrid; AUD 120,000 - 160,000; Full time

Job summary

GoSourcing seeks a Senior Security Operations Engineer/Specialist for a Federal Government client. The role is hands-on, focusing on monitoring, detection, and response to cyber threats using Microsoft Sentinel and Defender within hybrid work arrangements.

Start date is 28 September 2026, with a 12‑month initial contract, followed by a further 12 months and potentially two extensions. Location covers multiple states; office attendance is 2 days/week.

Qualifications

• Hands-on cyber security operations across enterprise or cloud environments.
• Experience with SIEM/SOAR platforms, preferably Microsoft Sentinel, incl. analytics rules and dashboards.
• Ability to detect, investigate and respond to security events and incidents.
• Automation and scripting to support security orchestration and response.
• Experience in Azure cloud logging, monitoring and security controls.
• Familiarity with WoAG policies such as ISM and Essential Eight controls.

Responsibilities

• Security Monitoring & Detection Engineering: develop analytics rules and dashboards to detect threats.
• Threat Hunting: perform proactive hunting using telemetry and threat intel.
• Incident Response: lead containment, eradication and recovery activities.
• Security Operations & Investigation: analyze events/logs; triage incidents by risk.
• Security Automation & Orchestration: build playbooks and scripts to speed responses.
• Vulnerability Management: identify and remediate vulnerabilities with DevOps teams.
• Threat Intelligence & Use Case Development: integrate intel into detections and hunts.
• Security Tool Management: tune and optimize security tools and integrations.
• Collaboration & Continuous Improvement: align with DevOps and design for better controls.
• Goverance Support & Documentation: maintain runbooks and WoAG evidence across processes.

Skills

Hands-on security operations

SIEM/SOAR (Microsoft Sentinel)

KQL queries

Incident detection & response

Security automation & scripting

Cloud (Azure)

WoAG policies (ISM/Essential Eight)

Tools

Microsoft Sentinel

Defender

Job description

Federal Gov't client is seeking Senior Security Operations Engineer/Specialist who will provide hands-on operational capability to actively monitor, detect, and respond to cyber threats, leveraging platforms such Microsoft Sentinel and Defender. This role will develop detection use cases, investigate alerts, and continuously improve the branch’s ability to prevent, detect, and respond to cyber incidents during both the planning and design phases and once the system is operational.

Note: This is a strongly hands-on technical capability role rather than a primarily operational or coordination-focused function.

Estimated start date: Monday, 28 September 2026

Initial contract duration: 12 months

Extension term: 12 months

Number of extensions: 2

Experience level: Senior - APS6 equivalent

Location of work: QLD, WA, ACT, VIC, NSW, SA

Working arrangements: Hybrid. Client has a requirement to attend the office for 2 days each week

Security clearance: Must be an Australian Citizen with an active Negative Vetting Level 1

Key duties and responsibilities

As a Security Operations Engineer/Specialist reporting to the Cyber Security Lead, you will be responsible for maintaining the integrity and confidentiality of the organisation’s data and information systems. You will play a hands‑on role in strengthening the security posture of the Branch’s cloud‑hosted solutions by working closely with the Technology Development team.

This role is critical in actively monitoring, detecting and responding to cyber security threats and incidents. You will leverage security platforms such as Microsoft Sentinel and Defender to investigate alerts, develop detection use cases, and implement improvements to enhance the organisation’s ability to prevent, detect and respond to cyber threats.

Key Responsibilities Include

• Security Monitoring & Detection Engineering: Configure, manage and optimise security monitoring platforms including development and tuning of analytics rules, dashboards and alerting use cases to detect malicious activity.
• Threat Hunting: Plan, execute and manage proactive threat hunting activities using available telemetry and threat intelligence. Continuously improve detection capabilities based on findings and emerging threats.
• Incident Response: Lead and support the response to cyber security incidents, including investigation, containment, eradication and recovery. Conduct root cause analysis and implement remediation actions to prevent recurrence.
• Security Operations & Investigation: Perform detailed analysis of security events, logs and alerts across cloud and enterprise environments. Triage and prioritise incidents based on risk and business impact.
• Security Automation & Orchestration: Develop and maintain automation playbooks and scripts to improve response times and reduce manual effort in security operations.
• Vulnerability Management: Identify, assess and prioritise vulnerabilities across systems, applications and infrastructure. Work with DevOps and development teams to ensure timely remediation.
• Threat Intelligence & Use Case Development: Manage and utilise threat intelligence feeds, incorporating intelligence into detection use cases, analytics rules and threat hunting activities.
• Security Tool Management: Configure, maintain and optimise security tools and platforms, identifying opportunities for improvement, integration and automation.
• Collaboration and Continuous Improvement: Work closely with DevOps, developers and security teams to improve detection coverage and feed operational learnings into system design and control implementation.
• Governance Support & Documentation: Maintain operational documentation, incident records and runbooks. Support alignment with WoAG policies through implementation and evidence collection.

Requirements

Essential criteria

Please prepare a statement of claims (less than 500 words) addressing the selection criteria. When preparing your statement of claims, please take into consideration the role and duties, and detail instances from your past that demonstrate how you meet the selection criteria. -

• Hands-on cyber security operations, including security monitoring, incident response, threat analysis, and investigation in enterprise or cloud environments.
• Working with SIEM/SOAR platforms, preferably Microsoft Sentinel, including development of analytics rules, KQL queries, alert tuning and dashboards.
• Incident detection and response, including triaging alerts, investigating security events and performing root cause analysis.
• Security automation and scripting, using tools to support orchestration and response activities.
• Working in cloud environments (preferably Microsoft Azure), with understanding of logging, monitoring and security controls
• Applying cyber security frameworks and best practices, including familiarity with Whole-of-Australian-Government (WoAG) policies such as ISM and Essential Eighttrols.