SOC Analyst | Threat Hunting & Incident Response

NCC Group; Canberra; Remote; AUD 110,000 - 140,000; Full time

Job summary

NCC Group is seeking a SOC Analyst in Canberra, ACT, Australia to join our Australian SOC team. You will act as the engine room of security operations, leading investigations, hunting threats, and fine‑tuning detections across APAC client environments.

You will work with a world‑class security stack, including Splunk, Sentinel, CrowdStrike, and Defender, with on‑call duties every three weeks and opportunities to mentor junior staff.

Qualifications

• 2–4 years in a SOC or high‑pressure security operations environment.
• Hands‑on proficiency in Splunk, Sentinel, CrowdStrike, and Microsoft Defender.
• Strong understanding of TCP/IP, Windows/Linux internals, Cloud Security.

Responsibilities

• Triage and Investigation: Lead investigations into complex security alerts utilising Splunk, Microsoft Sentinel, and SentinelOne SIEMs.
• Endpoint Response: Execute rapid containment and remediation actions using CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne EDR.
• Detection Tuning: Optimise detection rules using KQL and SPL to enhance our proactive defence posture.
• Threat Hunting: Support regular threat hunting activities based on the MITRE ATT&CK framework to uncover hidden malicious activity.
• Reporting & Mentorship: Produce detailed incident reports for technical and executive stakeholders.

Skills

Splunk

Sentinel

CrowdStrike

Microsoft Defender

TCP/IP

Windows/Linux internals

Cloud Security

MITRE ATT&CK

Threat Hunting

Tools

Splunk

Microsoft Sentinel

SentinelOne

CrowdStrike Falcon

Microsoft Defender for Endpoint

Job description

NCC Group is seeking a SOC Analyst in Canberra, ACT, Australia to join our Australian SOC team. You will act as the engine room of security operations, leading investigations, hunting threats, and fine‑tuning detections across APAC client environments.

You will work with a world‑class security stack, including Splunk, Sentinel, CrowdStrike, and Defender, with on‑call duties every three weeks and opportunities to mentor junior staff.