Lead Threat Detection & Incident Response Engineer

New Zealand Government; Auckland; On-site; NZD 180,000 - 240,000; Full time

Benefits offered by this job

Flexible working arrangements

Five weeks annual leave

Income Protection and Critical Illness

Professional development and career成长

Collaborative and inclusive culture

Job summary

NZ Transport Agency | Waka Kotahi is seeking three Principal Engineers, Detection and Response to strengthen its cyber defence via advanced threat detection, hunting and incident response. You will work across SIEM, XDR and EDR, tuning detection rules and building automation to reduce time to detect threats.

This senior role combines hands-on engineering with technical leadership and rapid incident support, requiring strong judgement and collaboration with security operations and intelligence

Qualifications

• Senior technical role with hands-on detection engineering and incident response.
• Ability to influence technical outcomes without formal people leadership.
• Must be able to obtain NZ national security clearance (SECRET).

Responsibilities

• Design, tune and maintain detection rules and analytics across SIEM/XDR/EDR.
• Lead threat hunting and translate threat intel into practical content.
• Identify gaps and drive continuous improvement of detection capabilities.
• Develop automation, playbooks and response workflows for security operations.
• Provide technical guidance on tool evaluations and reliability.

Skills

Threat detection design

Threat hunting

Incident response

SIEM/XDR/EDR platforms

Automation/SOAR

Technical leadership

Education

Relevant engineering degree or equivalent

Security certifications (GCDA/GCIA/GCIH) advantageous

Tools

SIEM

XDR

EDR

SOAR

Job description

NZ Transport Agency | Waka Kotahi is seeking three Principal Engineers, Detection and Response to strengthen its cyber defence via advanced threat detection, hunting and incident response. You will work across SIEM, XDR and EDR, tuning detection rules and building automation to reduce time to detect threats.

This senior role combines hands-on engineering with technical leadership and rapid incident support, requiring strong judgement and collaboration with security operations and intelligence