Solution Architect - Agentic SOC

Skillfield; Melbourne; Hybrid; AUD 140,000 - 210,000; Full time

Job summary

Skillfield in Melbourne is seeking a Solutions Architect to design the next generation of security operations for clients. You will own solution design for Agentic SOC and continuous threat exposure management (CTEM), architecting SIEM, SOAR and AI integration.

You’ll work with clients from first conversation to delivery, collaborating with engineers to turn designs into working solutions, and you’ll shape proposals and proofs of concept.

Qualifications

• Substantial experience as a solutions or security architect with a strong grounding in security operations.
• Hands-on experience designing and implementing SIEM and SOAR platforms, including detection engineering and automation playbooks.
• Experience with vulnerability and exposure management tools such as Tenable, Qualys, Rapid7, Wiz or XM Cyber.
• Experience with Microsoft Azure infrastructure, including Microsoft Sentinel, Microsoft Defender XDR and Azure Logic Apps.
• Practical experience building or integrating large language model (LLM) or agent-based automation on Azure AI Foundry, including Azure OpenAI, with a clear view of its risks in an operational setting.
• Familiarity with frameworks such as MITRE ATT&CK and the Gartner CTEM model.
• Scripting or programming skills (Python, KQL, SPL or similar) and experience with infrastructure as code.
• Strong client-facing skills: workshops, design writing and executive-level explanations.
• Consulting or managed security services experience is highly regarded.
• Full Australian working rights.

Responsibilities

• Design agentic SOC architectures where AI agents handle triage, enrichment, investigation and response under clear human oversight.
• Architect SIEM, SOAR and XDR platforms such as Microsoft Sentinel, Splunk, Google Security Operations or Cortex XSOAR, and integrate AI agents into them.
• Design CTEM programs that prioritise what the SOC acts on across vulnerability and exposure management, attack surface management, cloud security posture and simulations.
• Define guardrails for autonomous response and ensure actions are logged and auditable.
• Lead discovery and solution workshops with client SOC leaders, security architects and executives, translating operational pain into practical designs.
• Shape proposals, estimates and statements of work with our sales team, and present solutions with confidence.
• Build proofs of concept hands-on, including detection content, automation playbooks and agent workflows to validate designs.
• Act as design authority during delivery, guiding engineers and making trade-off calls.
• Define metrics to prove value (MTTD/MTD, analyst workload, exposure reduction).
• Track SOC, CTEM and AI vendor landscape and provide well-founded recommendations.

Skills

Solutions architecture

Security operations

SIEM

SOAR

XDR

Azure

Azure AI Foundry

Azure OpenAI

MITRE ATT&CK

Python

KQL

Cloud security

Tools

Microsoft Sentinel

Splunk

Cortex XSOAR

Azure AI Foundry

Azure OpenAI

Ten able

Job description

About Skillfield

Skillfield is a specialist technology consultancy operating at the intersection of cyber, data and AI. We partner with enterprise clients to protect, transform and enable their organisations through thoughtful, outcome-focused solutions. Our reputation is built on impact, not effort.

The role

Location: Melbourne, hybrid

We're looking for a Solutions Architect to design the next generation of security operations for our clients. Security operations centres (SOCs) are drowning in alerts, and artificial intelligence (AI) agents can now triage, investigate and respond alongside human analysts. You'll design the platforms that make that safe, measurable and genuinely useful.

You'll own solution design for Skillfield's Agentic SOC and continuous threat exposure management (CTEM) offerings. That means architecting how security information and event management (SIEM), security orchestration, automation and response (SOAR) and AI agents work together. It also means using a CTEM platform as the orchestrator that tells the SOC which exposures matter most. You'll work with clients from first conversation to delivery, and with our engineers to turn designs into working solutions.

What you'll do

• Design agentic SOC architectures where AI agents handle triage, enrichment, investigation and response under clear human oversight
• Architect SIEM, SOAR and extended detection and response (XDR) platforms such as Microsoft Sentinel, Splunk, Google Security Operations or Cortex XSOAR, and integrate AI agents into them
• Design CTEM programs that bring together vulnerability management, attack surface management, cloud security posture and breach and attack simulation, and use them to prioritise what the SOC acts on
• Define guardrails for autonomous response: what agents can do on their own, what needs approval, and how every action is logged and auditable
• Lead discovery and solution workshops with client SOC leaders, security architects and executives, and translate operational pain into practical designs
• Shape proposals, estimates and statements of work alongside our sales team, and present solutions with confidence
• Build proofs of concept hands‑on, including detection content, automation playbooks and agent workflows, to validate designs and de‑risk delivery
• Act as design authority during delivery, guiding engineers and making the calls when trade‑offs arise
• Define the metrics that prove value, such as mean time to detect and respond, analyst workload and exposure reduction
• Track the fast‑moving SOC, CTEM and AI vendor landscape and bring well‑founded recommendations to clients and to Skillfield's offering

About you

• Substantial experience as a solutions or security architect, with a strong grounding in security operations
• Hands‑on experience designing and implementing SIEM and SOAR platforms, including detection engineering and automation playbooks
• Experience with vulnerability and exposure management tools such as Tenable, Qualys, Rapid7, Wiz or XM Cyber
• Experience with Microsoft Azure infrastructure, including Microsoft Sentinel, Microsoft Defender XDR and Azure Logic Apps
• Practical experience building or integrating large language model (LLM) or agent‑based automation on Azure AI Foundry, including Azure OpenAI, and a clear view of its risks in an operational setting
• Familiarity with frameworks such as MITRE ATT&CK and the Gartner CTEM model
• Scripting or programming skills (Python, KQL, SPL or similar) and experience with infrastructure as code
• Strong client‑fac­ing skills: you can run a workshop, write a design and explain it to an executive
• Consulting, managed security services or professional services experience is highly regarded
• Full Australian working rights

Why Skillfield?

• Be part of a team serious about doing work that matters
• Join a culture that values clarity, autonomy and shared success
• Enjoy flexibility, strong support and performance‑based recognition

Ready to make a measurable impact?

Skillfield is committed to an inclusive workplace. If you need any adjustments during the recruitment process, let us know and we'll work with you.