Staff Security Engineer (Detection)

REA; City of Melbourne; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work model

Flexible leave options

Flexible parental leave

Volunteer leave & charity program

Hackdays

Job summary

REA is seeking a Staff Security Engineer to provide technical accountability for its detection engineering capability within a purpose-built detection platform. You will shape standards, direction and capability models across data flows, detections and response automation.

You’ll partner with Product, Platform and Engineering to prioritise work, lead long‑term initiatives and enable scalable detection engineering across the environment.

Qualifications

• Define detection engineering architectures, patterns and standards across multiple platforms.
• Translate cloud and application architectures into detection and response requirements.
• Configure and operate the detection platform and data flows (log ingestion, transformation, enrichment and automation).
• Lead review, tuning and validation of high‑fidelity detections and correlation logic.
• Build and maintain automated pipelines, tests and quality gates for detections.
• Analyze security events and logs during investigations and proactive threat hunting.
• Coordinate containment and communicate with incident response and stakeholders.

Responsibilities

• Identify, initiate and lead long‑term cross‑team initiatives to strengthen REA's detection and response capability.
• Configure and operate the detection platform and its data flows, including log ingestion, transformation, alert enrichment and response automation.
• Define detection patterns and technical approaches to identify malicious activity and review high‑fidelity detections.
• Build and maintain automated pipelines, tests and quality gates to prevent drift and coverage gaps.
• Investigate security alerts and incidents, coordinate containment and communicate with broader teams.

Skills

Detection architecture

Cloud security

Log analysis

Data pipelines

Threat hunting

MITRE ATT&CK

CI/CD security

SOAR automation

Mentoring

Tools

EDR

SIEM

CNAPP

SOAR

Identity platforms

Job description

We’re taking an engineering-led approach to security operations, building internal capability and technical depth. You’ll provide technical accountability for REA’s detection-engineering capability and help shape how we evolve detection and automation

Permanent role based either onsite in Melbourne or Sydney as well as open to remote in other locations

Where the team fits in

The Detection & Response team helps REA identify, investigate and respond to cyber threats across our environment. The team monitors security signals, validates alerts, investigates suspicious activity and leads or supports coordinated incident response, including technical investigation and containment in partnership with engineering teams. With an increasing focus on detection and response engineering, the team continually strengthens REA’s ability to spot threats earlier, reduce the impact of incidents and learn from events to improve our security posture.

What the role is all about

The Staff Security Engineer is a key role in the Detections & Response team that will provide technical accountability for REA’s detection engineering capability within our purpose-built detection platform. You’ll shape standards, technical direction and the capability model across data flows, detection requirements, testing and response automation. Working within our strategic goals, you'll partner with the team to prioritise and sequence the work that delivers them, bringing deep technical expertise to guide how we get there.

Day to day of the job

Identify, initiate and lead long‑term, cross‑team initiatives that strengthen REA's detection and response capability, aligning stakeholders and driving delivery in partnership with Product, Platform and Engineering teams. Configure and operate the detection platform and its data flows, including log ingestion, transformation, alert enrichment and response automation, while shaping the technical standards and patterns used to define and validate detections. Define detection patterns and technical approaches to identify malicious activity across our environment, and lead the review, tuning and validation of high‑fidelity detections and correlation logic that improve coverage, reduce false positives and enable the team to scale detection engineering capabilities. Build and maintain automated pipelines, infrastructure, tests and quality gates that validate detections and protect against configuration drift, regressions and coverage gaps. Analyse security events and logs to identify malicious activity, patterns and emerging attack techniques during investigations and proactive threat hunting. Assess threat intelligence, attacker techniques and relevant industry frameworks in the context of REA’s environment, using them to set detection priorities and guide refined detection patterns that continuously improve coverage and signal quality. Investigate security alerts and incidents, independently determine whether containment is required, coordinate technical response activities and communicate effectively with the wider incident response team, senior management and business stakeholders as needed. Produce and automate response playbooks to ensure rapid and effective containment and response. Contribute to purple‑team exercises and security testing to validate effectiveness of detections and identify gaps. Partner with Product, Platform and Engineering teams to ensure new systems and changes have appropriate logging, monitoring and detection coverage. Evaluate and use AI‑assisted and other emerging tooling to improve detection, support investigations and response automation, applying sound security judgement and attacker‑technique knowledge to guide investigative tasks and validate outputs. Mentor and share knowledge with other Security and Engineering team members through reviews, pairing and internal forums.

Who we’re looking for

• Ability to define detection engineering architectures, patterns and standards across multiple platforms, balancing detection coverage, signal quality, cost, performance, and operational impact
• Strong understanding of cloud and application architectures, including logging, monitoring, native security controls and common failure modes, with ability to translate these into detection and response requirements
• Proficiency in log analysis, scripting and query languages to investigate security events and evaluate detection behaviour, with the ability to define requirements for, review and validate complex detection logic, including edge cases and performance considerations
• Capability to configure and manage data pipelines, including log forwarding, transformation, cost‑conscious ingestion strategies, and observability pipeline tools
• Deep understanding of security observability tooling including EDR, SIEM, CNAPP, SOAR, and identity platforms, with ability to leverage their telemetry for high‑fidelity detections
• Strong knowledge of attacker techniques and kill‑chain concepts (e.g. MITRE ATT&CK) and how to map them into effective detections and coverage assessments
• Strong understanding of modern DevOps and systems‑engineering practices, including detection‑as‑code, source‑control workflows, infrastructure‑as‑code and CI/CD pipelines, with the ability to define standards and quality controls for building, testing, deploying and operating security tooling
• Ability to build automation workflows for security operations, including SOAR platforms and response orchestration, and document operational procedures through playbooks, runbooks and detection test cases

The REA experience

The physical, mental, emotional and financial health of our people is something we’ll never stop caring about. This is a place to learn and grow. Some of our Perks & Benefits include:

• A hybrid and flexible approach to working
• Flexible leave options including, birthday leave and purchase additional leave
• Flexible parental leave offering for primary and secondary carers
• Our Because We Care program offers employees volunteering leave, community grants, matched payroll giving and our Community Café donates 100% of revenue to charity
• Hackdays so you can bring your big ideas to life

Our commitment to Diversity, Equity, and Inclusion

We are committed to providing a working environment that embraces and values diversity, equity and inclusion. We believe teams with diverse ideas and experiences are more creative, more effective and fuel disruptive thinking.

We are an Australian-based digital media company with a passion for real estate. Our leading brand is Australia’s biggest property resource, realestate.com.au. We also operate the number one commercial property site, realcommercial.com.au, and have businesses that help property developers and other brands advertise with us. Whilst we live in Australia, we’ve also got ventures in Asia and North America, and have the vision of expanding our footprint further. Everything we do is driven by our purpose to ‘change the way the world experiences property’ – from product innovation to our international investments.