Threat Detection Engineer: SIEM/EDR Playbooks & AI Threats

Emanate Technology; Canberra; On-site; AUD 90,000 - 130,000; Full time

Job summary

The Threat Detection Engineer will join a federal government cyber team in Canberra, focusing on developing and maintaining detection content across SIEM, SOAR and EDR platforms.

You will work with cyber defence analysts and engineers in ITIL/Agile environments, tune rules, build playbooks, and uplift monitoring and response capabilities for AI misuse and data leakage. This is a contract/long-term engagement with NV1 clearance.

Responsibilities

• Develop detection use cases informed by threat models, vulnerabilities, intelligence, incident reports and industry frameworks.
• Build and maintain detection rule syntax across SIEM and EDR platforms.
• Create playbooks to support alert validation and incident response workflows.
• Maintain and enhance threat models using STRIDE, ATT&CK, attack path analysis and related methodologies.
• Assess emerging threats associated with AI platforms and develop monitoring controls for AI misuse, data leakage, prompt injection, model abuse and adversarial activity.
• Collaborate with architecture and engineering teams to translate threat modelling outcomes into monitoring and detection requirements.
• Maintain threat intelligence integrations across the SOC technology stack.
• Conduct research and analysis to develop new detection content and uplift existing rules.
• Support incident response activities under direction of the Incident Manager.
• Assist with onboarding new data sources to meet detection requirements.
• Provide feedback to improve intelligence production and reporting.
• Contribute to cyber exercises, planning activities and time-sensitive operations.

Job description

The Threat Detection Engineer will join a federal government cyber team in Canberra, focusing on developing and maintaining detection content across SIEM, SOAR and EDR platforms.

You will work with cyber defence analysts and engineers in ITIL/Agile environments, tune rules, build playbooks, and uplift monitoring and response capabilities for AI misuse and data leakage. This is a contract/long-term engagement with NV1 clearance.