Principal Detection and Response Engineer

New Zealand Transport Agency; Auckland; Hybrid; NZD 120,000 - 180,000; Full time

Benefits offered by this job

Flexible working

5 weeks annual leave

Income protection

Professional development

Inclusive culture

Job summary

New Zealand Transport Agency (NZTA) is seeking a seasoned security specialist to own threat detection and incident response. You will lead threat hunting, develop intelligence-led detections, and drive automation across SOAR playbooks and response workflows.

In this role, you will tune detection rules, validate content before deployment, and provide expert guidance on security tools and platforms. NZTA values Te Ao Māori awareness and public sector compliance.

Qualifications

• Experience designing, tuning and managing detection rules, correlation logic or behavioural analytics across SIEM, XDR or EDR platforms.
• Experience investigating suspicious activity and hunting threats using telemetry and threat intelligence.
• Familiarity with MITRE ATT&CK is beneficial; reduces detection gaps and improves response.
• Automation or scripting to improve security workflows; SOAR experience advantageous.

Responsibilities

• Own threat detection and support cyber incident response.
• Lead threat hunting and develop intelligence-led detections.
• Shape security automation and support major incident response.
• Design, tune and maintain detection rules and correlation logic across security platforms.
• Lead threat hunting activities and translate threat intelligence into actionable content.
• Identify detection coverage gaps and drive continuous improvement.

Skills

Threat detection design

Threat hunting

Automation scripting

MITRE ATT&CK familiarity

Education

GCDA/GCIA/GCIH certifications

Tools

SIEM

XDR

EDR

Job description

Key responsibilities include:

• Own threat detection and support cyber incident response
• Lead threat hunting and develop intelligence-led detections
• Shape security automation and support major incident response
• Designing, tuning and maintaining detection rules, correlation logic and behavioural analytics
• Leading threat hunting activities and translating threat intelligence into actionable detection content
• Identifying detection coverage gaps and driving continuous improvement across the detection capability
• Developing automation, SOAR playbooks and response workflows to improve security operations
• Setting quality standards and validating detection content before deployment
• Providing specialist expertise for security tool and platform evaluations
• Acting as a tactical responder for significant cyber incidents, supporting containment, eradication and recovery activities

Position Description Ko koe tēnei | About you

• Strong experience designing, tuning and managing detection rules, correlation logic or behavioural analytics across SIEM, XDR or EDR platforms
• Experience investigating suspicious activity and hunting threats using telemetry and threat intelligence, applying sound judgement when information is incomplete
• An evidence‑based approach to identifying detection gaps and turning threat insights into practical improvements, with familiarity with MITRE ATT&CK beneficial
• Experience using automation or scripting to improve security workflows, with an understanding of testing, assurance and safe deployment. SOAR experience is advantageous
• The ability to provide technical guidance, review detection content and strengthen detection and response practices through lessons learned
• An understanding of security and privacy obligations, with a willingness to develop knowledge of NZISM and New Zealand public sector requirements
• Relevant experience, qualifications, or a combination of both. Certifications such as GCDA, GCIA or GCIH are advantageous
• The ability to obtain and maintain a New Zealand national security clearance up to and including SECRET.
• You will demonstrate knowledge of, or a willingness to gain an understanding of Te Ao Māori and promote tikanga and Te Reo Māori. You will also have knowledge of, or a willingness to gain an appreciation of Te Tiriti o Waitangi (the Treaty of Waitangi) as it applies in the public service.

Mō mātou | About us

At NZTA, we deliver transport networks that connect people, places and New Zealand. Te Aukaha | Digital provides the technology and information services that enable better outcomes for our customers, partners and people.

Within Digital, Security protects NZTA's people, information and technology through resilient operations, assurance, governance and secure-by-design practices. As part of Security Operations and Resiliency, you'll help strengthen NZTA's 24/7 detection and response capability, working across threat detection, incident response and cyber resilience. You'll collaborate closely with security operations, threat intelligence, engineering and governance teams, as well as external cyber security partners and vendors.

Ka whiwhi koe i te aha | What you will get in return

• Flexible working arrangements that support work-life balance
• Five weeks annual leave
• Income Protection and Critical Illness Insurance for permanent employees
• Professional development and career growth opportunities
• A collaborative and inclusive culture committed to delivering meaningful outcomes for New Zealanders

Ready to help strengthen our detection and response capability? If you're ready to bring your detection engineering expertise and tactical response judgement to work with a clear public purpose, we'd love to hear from you.

Rā Katinga | Applications close:15 November 2026

For further information, email: [e-mail]

To be considered for this position you must have a legal right to live and work in New Zealand.

NZTA| Waka Kotahi is an equal opportunity employer (EOE). We recognise the importance of diversity and inclusion and are committed to providing a working environment that embraces these values. Please let us know if you need any support or have any access requirements that will help you through the recruitment process.

We encourage early applications as we may withdraw the advertising at any time.