Senior SOC Analyst

BluBiz Solutions; Melbourne; Hybrid; AUD 120,000 - 170,000; Full time

Benefits offered by this job

Flexible hybrid working

Competitive salary package

Learning & certifications

Career progression

Job summary

BluBiz Solutions is seeking a highly technical Senior SOC Analyst to lead the SOC from Melbourne. You will be the senior Level 2 analyst and escalation point, owning complex investigations and incident response while raising the bar for threat detection, response and reporting.

The role sits within our global SOC team and will set standards for quality. The successful candidate will mentor analysts, drive detection use cases and SOAR automation, with deep hands-on knowledge of Microsoft Sentinel

Qualifications

• At least 5 years of cybersecurity experience, including 3 years in a SOC and 2+ years operating at Level 2 or above.

Responsibilities

• Serve as Level 2 escalation point for alerts and incidents; own complex or high-severity cases through to resolution.
• Perform in-depth investigations across endpoint, identity, email, network, and cloud telemetry.
• Correlate events across Sentinel, Defender XDR and CrowdStrike to build an accurate picture of attacker activity.
• Validate, classify and prioritise incidents, and make sound escalation decisions.
• Lead and coordinate the technical response to security incidents across the full lifecycle: preparation, detection, containment, eradication, recovery and lessons learned.
• Execute containment actions per client runbooks.
• Collect and analyse forensic artefacts to support investigations.
• Produce incident reports and post-incident reviews for technical teams and exec stakeholders.
• Plan proactive threat hunts using KQL in Sentinel and CQL in Falcon Next-Gen SIEM.
• Design, build, test and fine-tune detection use cases, including Sentinel analytics rules, Defender XDR detections, Falcon IOAs and SIEM correlation rules.
• Develop and maintain Sentinel automation rules and playbooks and Falcon Fusion SOAR workflows.

Skills

Leadership

Incident response

Threat hunting

MITRE ATT&CK

Communication

Analytical thinking

Mentoring

Cloud security

Education

Bachelor's degree in CS/IT

Tools

Microsoft Sentinel

CrowdStrike Falcon

Defender XDR

Azure Logic Apps

KQL

CQL

Job description

We are looking for a highly technical Senior SOC Analyst who is ready to lead. You will be the senior Level 2 analyst and escalation point within our SOC, owning complex investigations and incident response while raising the bar for how our SOC detects, responds to, and reports on threats. Our SOC operates as a global team. Based in Melbourne, you will be our technical lead and standard-bearer for SOC quality, working closely with our global SOC analysts and platform engineers. You will set and uphold operating standards, coach analysts, drive the development of detection use cases and SOAR automation, and ensure every client receives consistent, proactive, high-quality service. Microsoft Sentinel and CrowdStrike Falcon are our two core platforms, and you will bring deep, hands‑on expertise in at least one of them and a solid working knowledge of the other.

Key responsibilities

Serve as the Level 2 escalation point for alerts and incidents raised by Level 1 analysts, and own complex or high-severity cases through to resolution.

Perform in-depth investigations across endpoint, identity, email, network, and cloud telemetry to determine scope, root cause, and impact.

Correlate events across Microsoft Sentinel, Microsoft Defender XDR and the CrowdStrike Falcon platform to build an accurate picture of attacker activity.

Validate, classify and prioritise incidents, and make sound, timely escalation decisions.

Lead and coordinate the technical response to security incidents across the full lifecycle: preparation, detection, containment, eradication, recovery and lessons learned.

Execute containment actions such as host isolation, account disablement, session revocation and indicator blocking, in line with agreed client runbooks.

Collect and analyse forensic artefacts (endpoint, memory, logs) to support investigations and evidence preservation.

Produce clear incident reports and post-incident reviews for both technical teams and executive stakeholders, including recommendations to prevent recurrence.

Plan and run proactive, hypothesis-driven threat hunts using KQL in Sentinel and Defender XDR, and CrowdStrike Query Language (CQL) in Falcon Next-Gen SIEM and Event Search.

Design, build, test and fine-tune detection use cases, including Sentinel analytics rules, Defender XDR custom detections, CrowdStrike custom IOAs and Next-Gen SIEM correlation rules.

Develop and maintain Sentinel automation rules and playbooks (Azure Logic Apps) and CrowdStrike Falcon Fusion SOAR workflows.

About you

At least 5 years of cybersecurity experience, including at least 3 years in a SOC and at least 2 years operating at Level 2 or above.

Ability to communicate clearly and calmly with clients during incidents, and present findings to both technical and non-technical audiences

Deep, hands‑on expertise in Microsoft Sentinel or CrowdStrike Falcon, with working knowledge of the other.

Advanced query skills in KQL or CrowdStrike Query Language (CQL), with the ability to quickly become proficient in both.

Proven experience leading incident response for real-world incidents such as ransomware, business email compromise, credential compromise and malware outbreaks.

Demonstrated threat hunting experience and a strong working knowledge of the MITRE ATT&CK framework.

Track record of developing and fine-tuning detection use cases and reducing false positives in a production environment.

Solid understanding of Windows, Linux and macOS internals, Active Directory, networking fundamentals and common attack techniques.

Experience investigating security events in cloud environments, particularly Microsoft 365 and Azure, with AWS exposure an advantage.

Experience guiding, mentoring or leading other analysts, whether formally or informally.

At least one current certification in our core platforms: Microsoft Certified: Security Operations Analyst Associate (SC-200), or a CrowdStrike Falcon certification such as CrowdStrike Certified Falcon Responder (CCFR), Falcon Hunter (CCFH), SIEM Analyst (CCSA) or SIEM Engineer (CCSE).

About us

BluBiz Solutions is an Australian-owned, award-winning ICT solutions and managed services provider based in Melbourne. Since 2017, we have delivered expertise across Enterprise Networking, Cybersecurity, Cloud and Infrastructure, Collaboration, Mobility and IT Service Support to clients in the not-for-profit, health, aged care, education, retail and construction sectors, many of whom have partnered with us for several years. We are a three-time CRN Fast 50 company, ISO 27001 certified end-to-end, a top-50 Australian Telstra partner, a Microsoft Modern Work Solution Designation partner and a 2025 Cisco Partner Winners Circle recipient. Cybersecurity is at the heart of what we do. Our managed Security Operations Centre (SOC) protects our clients around the clock, and we are investing to make it one of the most capable and trusted SOC services in the Australian mid-market.

A senior, high-impact role with real influence over how we shape and deliver our SOC services.

Exposure to a client portfolio and modern security platforms.

Ongoing investment in your learning, development and certifications.

Flexible hybrid working and a supportive, collaborative team culture.

A competitive salary package aligned to your experience.

A defined career pathway as our cybersecurity practice grows, with clear progression to Level 3 Analyst and SOC Manager, or into specialist areas such as detection engineering, threat intelligence, incident response and security architecture.