SOC Analyst (MSP) - Melbourne

Systima; Melbourne; Hybrid; AUD 90,000 - 130,000; Full time

Job summary

Systima in Melbourne is seeking an experienced SOC Analyst to join our NOC and SOC team, focusing on monitored security events for our managed clients. This role requires hands-on incident response and direct client communication during active incidents.

You will triage alerts, lead containment, tune detection rules, and collaborate with escalation and infrastructure teams to mature our security operations. Hybrid work from Collingwood office is available.

Qualifications

• Hands-on SOC experience required.
• Ability to lead incident response from triage to containment.
• Experience communicating with clients during ongoing incidents.
• Familiarity with threat detection tuning and runbooks.

Responsibilities

• Monitor and triage security alerts across EDR/XDR tooling.
• Lead initial incident response and containment; escalate as needed.
• Serve as client-facing point of contact during incidents.
• Tune detection rules and alert thresholds to reduce false positives.
• Collaborate on vulnerability and patch management oversight.
• Maintain SOC runbooks and escalation matrices.
• Participate in after-hours on-call SOC rotation.
• Help mature SOC capabilities as the function scales.

Skills

Networking fundamentals

SOC operations

EDR tooling

XDR tooling

Microsoft 365 / Azure / Entra ID

ACSC Essential Eight

Incident response

Client communication

On-call / shift work

Independent work

Job description

About Systima

Systima is a well-established Managed Service Provider with offices in Collingwood, Melbourne and Alexandria, Sydney, supporting small, medium and enterprise clients across Australia. This role sits within one of our dedicated Support Services pods, with particular ownership of a financially regulated client account where compliance and security expectations run higher than usual.

About the Role

We are looking for an experienced SOC Analyst to join our NOC and SOC team. You will monitor, triage and respond to security alerts across our managed client base, lead incident containment and escalation, and help mature our detection and response capability.

This is not an entry level role. We need someone who already has hands on SOC experience and can walk straight into live incident response, including speaking directly with clients while an incident is still unfolding.

What You Will Be Doing

• Monitor and triage security alerts across our endpoint detection and response tooling


• Lead initial incident response for confirmed security events, including containment actions and escalation


• Act as a client facing point of contact during security incidents, explaining what happened, what we are doing about it and what happens next in plain language


• Tune and improve detection rules and alert thresholds to reduce false positive load


• Partner with our technical escalation and infrastructure teams on vulnerability and patch management oversight


• Maintain SOC runbooks, escalation matrices and incident documentation to a consistent standard


• Participate in an after hours, on call SOC escalation roster


• Contribute to maturing our SOC function as it scales

What You Will Bring

• Solid networking fundamentals, including routing, firewalls, VPN and network segmentation, to accurately interpret alert context such as lateral movement or firewall and VPN log correlation. This is essential


• Hands on experience in a SOC, security operations or MDR adjacent role, ideally within an MSP or multi tenant managed security environment


• Demonstrated incident response experience, from triage through to containment, not just alert acknowledgement


• Strong working knowledge of EDR and XDR tooling, or directly transferable equivalents


• Working understanding of Microsoft 365, Azure and Entra ID security configuration


• Familiarity with the ACSC Essential Eight and how SOC activity maps to it


• A confident, client facing communicator, comfortable leading live conversations with clients during active security incidents and staying composed under pressure


• Able to operate independently on shift with minimal real time supervision

Nice to Have

• Formal incident management experience, for example ITIL incident or major incident management, combined with client facing communication skills


• Experience with managed detection and response partner escalation models


• Exposure to regulated industry clients and associated compliance monitoring


• Security certifications such as Security+, SC-200 or GCIH, or clearly demonstrable equivalent on the job depth

What We Offer

• Competitive salary, reviewed annually


• Hybrid working from our Collingwood office


• Funded certifications and dedicated training time


• Genuine ownership over how our SOC function is run and matured, not inheriting someone else's process


• A clear growth path as the security function scales, including senior analyst, infrastructure and team leadership tracks


• A business that documents things properly and treats security as a service, not a checkbox