Senior Threat Detection Engineer - SIEM/EDR & Threat Intel

XPT Software Australia; Canberra; On-site; AUD 120,000 - 160,000; Full time

Job summary

XPT Software Australia is seeking a Threat Detection Engineer to develop and maintain detection content for the SOC stack. You will coordinate with Cyber Defence Analysts to create rules for SIEM, SOAR and EDR platforms and support threat intelligence sharing across cloud and on-prem environments.

The role requires researching, testing, and maintaining detection use cases, playbooks, and threat models, while contributing to process documentation in an ITIL and Agile setting.

Qualifications

• Experience developing threat detection content.
• Proficient with SIEM/EDR platforms.
• Knowledge of ATT&CK/STRIDE methodologies.

Responsibilities

• Develop use cases from threat models, risks, incidents and frameworks.
• Create detection rule syntax for SIEM/EDR.
• Develop playbooks for alert validation and context.
• Maintain threat models using STRIDE/ATT&CK and attack path analysis.
• Assess AI-related threats and content.
• Collaborate with architecture to implement monitoring and detection.
• Maintain threat intelligence integrations across SOC stack.
• Conduct research for new detection content.
• Tune detection rules with Cyber Defence Analysts.
• Assist in threat model development and content gaps.
• Support incident response as directed by incident manager.
• Onboard new data sources to meet use-case requirements.
• Provide feedback to improve intelligence production and reporting.
• Support planned exercises and time-sensitive operations.

Skills

Threat modelling

SIEM/EDR

ATT&CK

STRIDE

Threat intel

Cloud/on‑prem

Playbooks

Tools

Detection rules

Job description

XPT Software Australia is seeking a Threat Detection Engineer to develop and maintain detection content for the SOC stack. You will coordinate with Cyber Defence Analysts to create rules for SIEM, SOAR and EDR platforms and support threat intelligence sharing across cloud and on-prem environments.

The role requires researching, testing, and maintaining detection use cases, playbooks, and threat models, while contributing to process documentation in an ITIL and Agile setting.