SOC Security Operations Lead — Threat Detection & SIEM

Optus; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Benefits offered by this job

Flexible working arrangements

Parental Leave up to 16 weeks

U learning micro-credentials

On-site childcare

Employee discounts

Job summary

Optus is seeking an SOC Specialist to deliver security monitoring, threat detection, and incident response for the Enterprise and clients. The role requires hands-on work with SIEMs, cloud proxies, and security tooling in a security operations context.

The ideal candidate has 3–5 years in security operations, CISSP/CISM/CRISC preferred, and experience with Splunk, Tenable and Firepower. Australian citizenship is required; hybrid work options may apply.

Qualifications

• 3–5 years’ experience in security operations.
• Strong analytical and problem-solving skills.
• Certifications such as CISSP, CISM, or CRISC preferred.
• Experience with SIEM, logging, triage, and alerting.
• Familiarity with frameworks like NIST/ISM.

Responsibilities

• Investigate complex cases by correlating patterns from SIEM platforms (e.g., Splunk, DEVO) to identify threats.
• Configure, manage, upgrade, and maintain SIEM platforms; develop and tune use cases, alerts, dashboards, and reports.
• Create, document, and refine processes for handling and monitoring security solutions, ensuring efficiency and compliance.
• Collaborate with technical teams to onboard logs and baseline detection thresholds.
• Configure, manage, upgrade, and maintain Cloud Web Proxy platforms (Zscaler).
• Participate in security incident response processes, including red team exercises; resolve issues to prevent recurrence.
• Develop reporting frameworks and deliver operational security reports.

Skills

SIEM experience

Analytical skills

Problem solving

Security incident response

Education

CISSP/CISM/CRISC certifications

Tools

Splunk

Tenable

Symantec Endpoint Protection

Firepower IPS/IDS

Job description

Optus is seeking an SOC Specialist to deliver security monitoring, threat detection, and incident response for the Enterprise and clients. The role requires hands-on work with SIEMs, cloud proxies, and security tooling in a security operations context.

The ideal candidate has 3–5 years in security operations, CISSP/CISM/CRISC preferred, and experience with Splunk, Tenable and Firepower. Australian citizenship is required; hybrid work options may apply.