Threat Detection Engineer - SIEM/EDR (APS6, Hybrid)

It Alliance Australia; Canberra; Hybrid; AUD 110,000 - 140,000; Full time

Job summary

It Alliance Australia seeks a Senior Cyber Threat Analyst - SIEM for a Federal Government client in Canberra. This APS6, full-time 3-year contract (12 months with 24 months extension) offers hybrid working. Baseline security clearance is required; tentative start 17 Oct 2026. You will develop detections across SIEM/EDR/SOAR and coordinate with Cyber Defence Analysts.

The role emphasizes threat modelling, content development, and threat intelligence sharing in Cloud and on-prem environments.

Qualifications

• Minimum five years' experience in cyber security operations.
• Experience with SIEM, SOAR and EDR platforms.
• Ability to develop and tune detections and playbooks.
• Familiarity with threat modelling methodologies (STRIDE, ATT&CK).
• Knowledge of ASD/ACSC, NIST, MITRE ATLAS and OWASP LLM Top 10.

Responsibilities

• Develop threat detection content and use cases from threat models, risks, and intelligence.
• Create detection rule syntax for SIEM and EDR technologies.
• Develop playbooks for alert validation and incident response.
• Maintain threat models using STRIDE, ATT&CK and attack path analyses.
• Collaborate with architecture/engineering to translate models into monitoring capabilities.
• Maintain threat intelligence integrations across the SOC stack.
• Conduct research for new detection content and improvements.
• Assist in threat model development and content onboarding for new data sources.

Skills

Threat detection

Threat modelling

SIEM expertise

EDR platforms

SOAR

AI security monitoring

Automation and scripting

Python

Bash

Incident response

Threat intelligence

Communication & stakeholder engagement

Education

GIAC

SANS

CISSP

GCIA

GCIH

Tools

Splunk

Microsoft Sentinel

QRadar

Elastic

CrowdStrike

Microsoft Defender for Endpoint

Carbon Black

Job description

It Alliance Australia seeks a Senior Cyber Threat Analyst - SIEM for a Federal Government client in Canberra. This APS6, full-time 3-year contract (12 months with 24 months extension) offers hybrid working. Baseline security clearance is required; tentative start 17 Oct 2026. You will develop detections across SIEM/EDR/SOAR and coordinate with Cyber Defence Analysts.

The role emphasizes threat modelling, content development, and threat intelligence sharing in Cloud and on-prem environments.