Solution Architect - Agentic SOC

Skilledfield; Melbourne; Hybrid; AUD 140,000 - 200,000; Full time

Benefits offered by this job

Flexible work arrangement

Supportive culture

Performance-based recognition

Job summary

Skillfield is a specialist technology consultancy focused on cyber, data, and AI. We are seeking a Solutions Architect to design the next generation of security operations for our clients in Melbourne, hybrid.

You will own solution design for Agentic SOC and CTEM offerings, architecting SIEM, SOAR, XDR and AI agent integration, and leading workshops from first conversation to delivery. You will work with engineers to turn designs into working solutions and shape proposals with the sales team.

Qualifications

• Extensive experience as a solutions or security architect in security operations.
• Hands-on design and implementation of SIEM and SOAR platforms, including detection engineering and automation.
• Experience with vulnerability and exposure management tools (Tenable, Qualys, Rapid7, Wiz, XM Cyber).
• Experience with Microsoft Azure infrastructure, including Microsoft Sentinel, Defender XDR and Azure Logic Apps.
• Practical experience building or integrating LLM/agent-based automation on Azure AI Foundry, including Azure OpenAI.
• Familiarity with MITRE ATT&CK and the Gartner CTEM model.
• Scripting or programming skills (Python, KQL, SPL) and experience with infrastructure as code.
• Strong client-facing skills: able to run workshops and explain designs to executives.
• Consulting, managed security services or professional services experience is highly regarded.
• Full Australian working rights.

Responsibilities

• Design agentic SOC architectures with AI agents for triage, enrichment, investigation and response.
• Architect SIEM, SOAR and XDR platforms and integrate AI agents.
• Design CTEM programs to prioritise SOC actions and risk exposure.
• Define guardrails for autonomous response and logging.
• Lead discovery workshops with client SOC leaders and executives.
• Shape proposals, estimates and statements of work with the sales team.
• Build proofs of concept including detection content and automated playbooks.
• Act as design authority during delivery and guide engineers.
• Define value metrics like MTTD/MTTR and exposure reduction.
• Track SOC/CTEM/AI vendor landscape and provide recommendations.

Skills

Solutions/security architect

SIEM/SOAR design

Vulnerability/exposure management

Azure Sentinel / Defender XDR

Azure AI Foundry / Azure OpenAI

MITRE ATT&CK / CTEM

Scripting / IaC (Python, KQL, SPL)

Client-facing workshop skills

Consulting / managed security services

Australian working rights

Tools

Microsoft Sentinel

Splunk

Cortex XSOAR

Azure Logic Apps

Job description

Skillfield is a specialist technology consultancy operating at the intersection of cyber, data and AI. We partner with enterprise clients to protect, transform and enable their organisations through thoughtful, outcome-focused solutions. Our reputation is built on impact, not effort.

The role

Location: Melbourne, hybrid

We're looking for a Solutions Architect to design the next generation of security operations for our clients. Security operations centres (SOCs) are drowning in alerts, and artificial intelligence (AI) agents can now triage, investigate and respond alongside human analysts. You'll design the platforms that make that safe, measurable and genuinely useful.

You'll own solution design for Skillfield's Agentic SOC and continuous threat exposure management (CTEM) offerings. That means architecting how security information and event management (SIEM), security orchestration, automation and response (SOAR) and AI agents work together. It also means using a CTEM platform as the orchestrator that tells the SOC which exposures matter most. You'll work with clients from first conversation to delivery, and with our engineers to turn designs into working solutions.

What you'll do

• Design agentic SOC architectures where AI agents handle triage, enrichment, investigation and response under clear human oversight
• Architect SIEM, SOAR and extended detection and response (XDR) platforms such as Microsoft Sentinel, Splunk, Google Security Operations or Cortex XSOAR, and integrate AI agents into them
• Design CTEM programs that bring together vulnerability management, attack surface management, cloud security posture and breach and attack simulation, and use them to prioritise what the SOC acts on
• Define guardrails for autonomous response: what agents can do on their own, what needs approval, and how every action is logged and auditable
• Lead discovery and solution workshops with client SOC leaders, security architects and executives, and translate operational pain into practical designs
• Shape proposals, estimates and statements of work alongside our sales team, and present solutions with confidence
• Build proofs of concept hands-on, including detection content, automation playbooks and agent workflows, to validate designs and de-risk delivery
• Act as design authority during delivery, guiding engineers and making the calls when trade-offs arise
• Define the metrics that prove value, such as mean time to detect and respond, analyst workload and exposure reduction
• Track the fast-moving SOC, CTEM and AI vendor landscape and bring well-founded recommendations to clients and to Skillfield's offering

About you

• Substantial experience as a solutions or security architect, with a strong grounding in security operations
• Hands-on experience designing and implementing SIEM and SOAR platforms, including detection engineering and automation playbooks
• Experience with vulnerability and exposure management tools such as Tenable, Qualys, Rapid7, Wiz or XM Cyber
• Experience with Microsoft Azure infrastructure, including Microsoft Sentinel, Microsoft Defender XDR and Azure Logic Apps
• Practical experience building or integrating large language model (LLM) or agent-based automation on Azure AI Foundry, including Azure OpenAI, and a clear view of its risks in an operational setting
• Familiarity with frameworks such as MITRE ATT&CK and the Gartner CTEM model
• Scripting or programming skills (Python, KQL, SPL or similar) and experience with infrastructure as code
• Strong client-facing skills: you can run a workshop, write a design and explain it to an executive
• Consulting, managed security services or professional services experience is highly regarded
• Full Australian working rights

Why Skillfield?

• Be part of a team serious about doing work that matters
• Join a culture that values clarity, autonomy and shared success
• Enjoy flexibility, strong support and performance-based recognition

Skillfield is committed to an inclusive workplace. If you need any adjustments during the recruitment process, let us know and we'll work with you.