Vice President, Security Detection & Response, Global Information Security

Bank of America; Sydney; On-site; AUD 180,000 - 240,000; Full time

Job summary

Bank of America in Sydney is seeking a Security Detection & Response Analyst (SDR II) to join the GIS Monitoring and Triage team. You will operate across end-to-end detection, investigation, and response, applying automation and AI-driven enhancements to improve security outcomes.

The role requires strong experience in security operations, with MITRE ATT&CK knowledge, and the ability to guide junior staff and communicate clearly with technical and non-technical stakeholders.

Qualifications

• Experience in security operations, incident response, and detection engineering within production environments.
• Ability to build and tune detections and response workflows across multiple domains.
• Proficient in log analysis, telemetry interpretation, and data correlation using query languages.

Responsibilities

• Operate end-to-end detection and response lifecycle (detect → investigate → respond → improve).
• Analyze logs/telemetry from multiple sources to establish attack scope and root cause.
• Develop/detect improved detection logic and coverage using MITRE ATT&CK.
• Coordinate containment, isolation, escalation, and remediation during incidents.
• Maintain automation/orchestration, including SOAR workflows and scripted responses.
• Document findings and communicate updates to stakeholders.

Skills

Security operations

Incident response

Detection engineering

Threat detection

MITRE ATT&CK

KQL

SPL

SQL

SOAR

Automation

SIEM

EDR/XDR

Cloud security

Leadership

Communication

Education

Cyber Security Certificate

Tools

SIEM

EDR/XDR

Job description

Job Description: At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. We do this by driving Responsible Growth and delivering for our clients, teammates, communities and shareholders every day. Being a Great Place to Work and providing a culture of caring is core to how we drive Responsible Growth. We are intentional about fostering an inclusive workplace where every teammate has the opportunity to succeed, build a career and contribute to our shared success. This includes attracting and developing exceptional talent, recognizing and rewarding performance, and supporting our teammates’ physical, emotional, and financial wellness through affordable, competitive and flexible benefits. We value the unique perspectives individuals bring from all backgrounds and career paths - whether shaped by military service, community college education, or a wide range of work and life experiences. These journeys foster resilience, leadership and innovation, strengthening our workforce and positively impact the communities we serve. Bank of America is committed to an in-office culture that supports collaboration, engagement, and career development. Our approach includes clear in-office expectations, while providing an appropriate level of flexibility based on role-specific responsibilities and business needs. At Bank of America, you can build a successful career with opportunities to learn, grow, and make an impact. Join us!

Vice President, Security Detection & Response, Global Information Security, Sydney

Working Pattern:

This is a full-time role (38 hours per week), with standard working hours of 9:00AM to 7:30PM AEST 4 days per week (Sunday to Wednesday) to align with the nature of the support provided by the team. Flexibility may occasionally be required to support business, operational, or project deliverables.

Role Description:

We are seeking an experienced and motivated Security Detection & Response Analyst (SDR II) to join the GIS Monitoring and Triage team. This role supports cybersecurity operations across threat detection, investigation, response, and continuous service improvement. You should be an experienced security practitioner capable of operating within the end-to-end detection and response lifecycle (detect → investigate → respond → improve), combining broad analytical capability with an engineering mindset to rapidly identify, investigate, and contain threats. The analyst will operate across multiple security domains, validating detections, investigating threats, and executing response actions with sound judgment. This role requires cross-domain security expertise, broad analytical and engineering capabilities, and the ability to leverage automation, orchestration, and AI-driven technologies to improve detection outcomes, reduce manual effort, and continuously enhance overall security effectiveness.

Responsibilities:

• You will operate within the end-to-end detection and response lifecycle (detect → investigate → respond → improve), including analyzing logs and telemetry from multiple sources to establish attack scope, impact, and root cause.
• You will build, validate, tune, and optimize detection logic and coverage, leveraging attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK to improve accuracy and reduce false positives.
• Execute and coordinate security event response activities, including containment, isolation, escalation, and remediation, applying sound judgment during active engagements.
• You will maintain and improve automation and orchestration capabilities, including SOAR workflows, automated playbooks, scripted response actions, and AI-driven enhancements to reduce manual effort and improve detection and response outcomes.
• Accountable for measurable improvements in MTTR, detection quality, and signal-to-noise ratio.
• You will document and communicate security event findings, including timelines and lessons learned, while providing clear updates to stakeholders and driving continuous improvement in detection and response processes.
• Identify gaps in monitoring and detection coverage, contributing to operational maturity through continuous improvement initiatives, metrics, and enhancements to detection, response, and automation capabilities.
• Support integration of partner use cases into detection and monitoring workflows.
• Guide and instruct junior members of the team to support the achievement of professional goals.

What we are looking for:

• Experience in security operations, incident response, detection engineering, or related cybersecurity functions within a production environment.
• Experience in security detection, investigation, and response across multiple domains, with the ability to pivot across data sources and independently manage end-to-end investigations from initial triage through post-incident improvement.
• Ability to build, validate, and tune detections and response workflows, including reducing false positives.
• Considerable proficiency in log analysis, telemetry interpretation, and cross-system data correlation, including the ability to query, manipulate, and optimize data using KQL, SPL, SQL, or similar languages for investigative and detection use cases.
• Practical experience with containment, response actions, and automation, including developing or maintaining SOAR workflows, API integrations, and scripted response actions using sound judgment.
• Experience with security platforms and technologies, including SIEM, EDR/XDR, identity security, and cloud security.
• Working knowledge of identity and access systems and common attack paths, including credential theft, privilege escalation, and session/token abuse.
• Considerable understanding of attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK.
• Record of improving operational effectiveness, including reducing alert noise, improving detection coverage, and decreasing mean time to detect and respond.
• Great analytical, decision-making, and communication skills, including the ability to clearly articulate findings, provide timely incident updates to both technical and non-technical stakeholders, and operate effectively in high-pressure scenarios.
• Ability to operate with minimal supervision and make risk-informed decisions quickly.

Skills that will help:

• Exceptional communication and executive presence, with the ability to influence at all organizational levels.
• Process discipline.
• Leadership competency in geographically diverse matrixed environment.
• Relevant Cyber Security Certificate.
• Worked in SOC environment before.
• Familiarity with Cyber Security and Information Technology.
• Strong problem-solving and critical thinking skills.
• Effective communication and interpersonal skills.

At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. Responsible Growth is how we run our company and how we deliver for our clients, teammates, communities and shareholders every day. One of the keys to driving Responsible Growth is being a great place to work for our teammates around the world. We’re devoted to being a diverse and inclusive workplace for everyone. We hire individuals with a broad range of backgrounds and experiences and invest heavily in our teammates and their families by offering competitive benefits to support their physical, emotional, and financial well‑being. Bank of America believes both in the importance of working together and offering flexibility to our employees. We use a multi-faceted approach for flexibility, depending on the various roles in our organization. Working at Bank of America will give you a great career with opportunities to learn, grow and make an impact, along with the power to make a difference. Join us!

Partnering Locally

Learn about some of the ways Bank of America is making a difference in the communities we serve.

Global Impact

Learn about the six areas that guide Bank of America’s efforts to help make financial lives better for customers, clients, communities and our teammates.

Opportunity and Inclusion

Each employee brings unique skills, background and opinions. We see opportunity and inclusion as our platform for innovation and a key component in our success.

Our Values

Learn about our four values that represent what we believe.