Senior Threat Detection Engineer — SIEM/EDR & Playbooks

Whizdom; Canberra; Hybrid; AUD 120,000 - 170,000; Full time

Benefits offered by this job

Hybrid working arrangements

Job summary

Whizdom in Canberra is seeking a Senior Threat Detection Engineer to develop and maintain detection content across SIEM, SOAR and EDR platforms. You will translate threat intelligence into effective monitoring, detection and response capabilities in a fast-paced, cyber-focused environment.

The role requires five or more years in cyber security operations, hands-on experience with major SIEM tools (Splunk, Microsoft Sentinel, IBM QRadar, Elastic) and strong threat modelling skills (STRIDE, MITRE

Qualifications

• Five years or more in cyber security operations.
• Proven in creating detection content across at least two enterprise SIEM platforms.
• Experience in SIEM, SOAR and EDR detections.

Responsibilities

• Develop detection use cases based on threat models and industry frameworks.
• Maintain detection-rule syntax across SIEM and EDR technologies.
• Create playbooks to support alert validation, incident response and automation.
• Maintain threat models using STRIDE, MITRE ATT&CK and attack-path analysis.
• Identify detection opportunities and coverage gaps.
• Collaborate with architecture and engineering teams to translate threat-modelling outcomes into detection and response capabilities.
• Maintain threat-intelligence integrations across the SOC stack.
• Test, tune and improve detection rules with cyber defence analysts.
• Support onboarding of new data sources for detection use cases.

Skills

Threat detection engineering

SIEM platforms

SOAR/EDR

Threat modelling

Python

Security documentation

Stakeholder engagement

Tools

Splunk

Microsoft Sentinel

IBM QRadar

Elastic

Job description

Whizdom in Canberra is seeking a Senior Threat Detection Engineer to develop and maintain detection content across SIEM, SOAR and EDR platforms. You will translate threat intelligence into effective monitoring, detection and response capabilities in a fast-paced, cyber-focused environment.

The role requires five or more years in cyber security operations, hands-on experience with major SIEM tools (Splunk, Microsoft Sentinel, IBM QRadar, Elastic) and strong threat modelling skills (STRIDE, MITRE