Staff Incident Response Commander

Sociable Tech Pty Ltd; Sydney; On-site; AUD 221,000 - 228,000; Full time

Job summary

Sociable Tech Pty Ltd is urgently seeking a senior incident commander to lead the most complex security incidents end‑to‑end. This hands‑on role involves forensics across web apps, APIs, containers and multi‑cloud infrastructure, with leadership briefings for senior executives.

You will shape incident response processes, tooling and mentoring, ensuring rapid containment and effective remediation across multiple teams and partners.

Qualifications

• Extensive front‑line incident response and digital forensics experience.
• Hands‑on investigation of web applications and APIs, cloud and container compromises.
• Cloud-native and container forensics, including Kubernetes.
• Scripting in Bash and at least one interpreted language (e.g., Python).
• Knowledge of ISO 27001, SOC 2, HIPAA, GDPR and PCI; on‑call rotation likely.

Responsibilities

• Lead complex security incidents from first alert to closure, while performing forensic investigations.
• Coordinate with internal teams and external partners and drive remediation.
• Build tooling for evidence collection at scale and conduct retrospectives and exercises.
• Brief senior leadership clearly under pressure and mentor responders.

Skills

Incident response

Digital forensics

Kubernetes

Cloud platforms

Python scripting

Linux/Windows forensics

Tools

CrowdStrike Falcon

SIEM analytics

Bash

Python

Job description

Job Type: Contract position | Casual position

Job Description

Cox Purtell 12-month Sydney contract with a global software company Hands-on forensics across Kubernetes, AWS and GCP

Senior IC role shaping process, tooling and mentoring About the client Our client is a global software and digital media company whose products are used by individuals and enterprises around the world.

It’s cyber defence centre protects the company’s products, platforms and customers, working closely with engineering, product and partner teams. The incident response team handles serious, high-visibility security events across modern cloud and application environments. It is a team that values sound judgement, composure and genuine technical depth.

About the role

This is one of the most senior incident command roles in the team, and it stays hands‑on. You will lead the most complex security incidents from first alert to closure while doing the forensic investigation yourself, across web applications, APIs, containers and multi‑cloud infrastructure.

You will bring order to incidents that span many internal teams and external partners, and move comfortably between deep technical analysis and clear briefings for senior leadership. Beyond live incidents, you will help shape how the team responds through better process, tooling, exercises and mentoring.

Duties

Command complex security incidents across the full response lifecycle, coordinating internal teams, external partners and their security operations centres. Personally investigate web application, API, cloud and container compromises, including credential and data‑exposure scenarios. Collect, preserve and analyse forensic evidence across hosts, networks, cloud platforms and large log sources, keeping defensible records throughout.

Brief senior leadership clearly under pressure, and assign and drive remediation across multiple teams and organisations. Build tooling for evidence collection at scale, and lead retrospectives, tabletop exercises, training and mentoring for responders and commanders.

Requirements

Extensive front‑line incident response and digital forensics experience across many major incidents, with proven command of the full incident lifecycle. Hands‑on investigation of web application and API compromises, such as broken access control, authentication and authorisation bypass, IDOR, API abuse and CMS exploitation. Cloud‑native and container forensics, including Kubernetes and ep…

Deep host and network forensics, including Linux internals and Windows and macOS artefacts. EDR at scale (for example CrowdStrike Falcon), complex SIEM analytics, and log and data analysis across large platforms and data warehouses. Scripting in Bash and at least one interpreted language, such as Python.

Working knowledge of ISO 27001, SOC 2, HIPAA, GDPR and PCI. Willingness to join an on‑call rotation and respond to critical events. Highly regarded: Azure, malware triage and reverse engineering, GCFA, GCIH, GNFA or cloud security certifications, and a government or law‑enforcement investigation background.

Salary benefits: (incl Super) Work Type: Contract Salary: $1200-1235 Job Publish: 06-10-2026 Job Expire: 05-11-2026