Threat Intelligence & Threat Hunting Lead

Decipher Bureau; Melbourne; On-site; AUD 120,000 - 160,000; Full time

Job summary

Decipher Bureau is building a brand-new Threat Intelligence and Threat Hunting capability within its Cyber Defence team in Melbourne. You will be the hands-on technical lead, owning the design and delivery of hunting, intel, and automation initiatives across IT, OT and cloud environments.

The role focuses on hypothesis-led hunts, threat actor context, and scalable detections. You will work with senior stakeholders and external intel partners in a genuinely collaborative, tool-agnostic team.

Qualifications

• 4+ years in threat hunting, cyber threat intelligence, DFIR or related field.
• Hands-on hunting with endpoint, network, cloud and identity telemetry.
• Strong knowledge of forensic artefacts, adversary TTPs and hunt methodology.
• Experience with SIEM, EDR/XDR and threat intelligence platforms.
• Working knowledge of MITRE ATT&CK, Cyber Kill Chain and Diamond Model.
• Clear communication with technical and non-technical audiences.

Responsibilities

• Lead the build and continual improvement of threat hunting and threat intelligence capability.
• Plan and run hypothesis-led threat hunts and IoC sweeps.
• Translate hunts into automated detections, playbooks and use cases mapped to MITRE ATT&CK.
• Centralise threat intelligence sources for security monitoring and incident response.
• Support incident response with threat actor context and technical analysis.
• Produce threat intel reporting and briefings for technical teams and stakeholders.
• Build relationships with external intel providers, peers, and government.

Skills

Threat hunting

Threat intelligence

DFIR

SIEM

EDR/XDR

MITRE ATT&CK

Communication

Tools

SIEM

EDR/XDR

Threat intel tools

Job description

A major Australian energy and critical infrastructure organisation is building a brand-new Threat Intelligence and Threat Hunting capability inside its Cyber Defence team, and they need a hands-on technical lead to own it.

This is an individual contributor role. You’ll be the technical lead and escalation point for hunting and intel, working closely with Cyber Defence, Offensive Security, Network Security and OT Security. For the first six months, the focus is roughly 70% hunting and 30% intelligence.

If you can explain what “evil” looks like in endpoint and network telemetry, and
you’d enjoy building a hunting program from scratch in an environment that genuinely matters, read on.

What’s on offer

• The chance to design and own a new capability rather than inherit someone else’s
• Real scope: IT, OT and cloud environments in critical infrastructure
• Room to grow your detection engineering and scripting skills, with support from the wider cyber team
• Exposure to senior stakeholders through threat actor briefings
• A genuinely collaborative team, and they’re tool agnostic

What you’ll be doing

• Lead the build and continuous improvement of the threat hunting and threat intelligence capability
• Plan and run hypothesis-driven threat hunts: threat-led investigations into specific actors and TTPs, broad IoC sweeps, and theory-based hunts (for example DNS exfiltration)
• Turn successful hunts into automated detections, playbooks and use cases mapped to MITRE ATT&CK
• Centralise and curate threat intelligence sources and feed them into security monitoring and incident responseSupport incident response with threat actor context and technical analysis
• Produce threat intel reporting and occasional briefings for technical teams and senior stakeholders
• Build relationships with external intel providers, industry peers and government agencies

What you’ll bring

Must-have:

• 4+ years in threat hunting, cyber threat intelligence, DFIR or a closely related discipline
• Hands-on hunting experience using endpoint, network, cloud and identity telemetry
• Strong understanding of forensic artefacts and adversary TTPs, and the ability to walk through a hunt methodology end to end
• Experience with SIEM, EDR/XDR and threat intelligence platforms for investigation and hunting
• Working knowledge of MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model
• Clear communication with both technical and non-technical audiences

Desirable:

• DFIR background strongly preferred
• Detection engineering and scripting experience (willingness to learn is fine)
• OT, energy, utilities or telco experience
• Experience tracking APT activity and building threat actor dossiers
• Malware analysis skills
• Certifications such as GCFA, GCTI, GCIH, GNFA or CTIA

Essential requirement

Australian citizens, permanent residents and New Zealand citizens only. Unfortunately, we can’t consider visa holders for this role.

About Decipher Bureau

Decipher Bureau is Australia’s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don’t just match skills to a job description. We take the time to understand the technical demands of a role and whether a candidate will genuinely thrive in the team. Because the right placement beats a quick one, every time.