Principal Detection and Response Engineer

New Zealand Government; Palmerston North; Vor Ort; NZD 140.000 - 190.000; Vollzeit

Benefits dieser Stelle

Five weeks annual leave

Income protection

Career development opportunities

Zusammenfassung

NZ Transport Agency | Waka Kotahi (NZTA) seeks three Principal Engineers, Detection and Response to strengthen its cyber defence through advanced threat detection, threat hunting and incident response. You will work across SIEM, XDR and EDR platforms, designing and tuning detection content and leading response efforts.

You will contribute to automation, playbooks and tactical incident response while collaborating with security operations and threat intelligence teams to strengthen NZTA's cyber

Qualifikationen

• Design, tune and maintain detection rules across SIEM/XDR/EDR.
• Investigate suspicious activity and hunt threats using telemetry and intel.
• Experience translating threat intel into actionable detections; MITRE ATT&CK familiarity helpful.
• Automation/SOAR skills to improve workflows and playbooks.

Aufgaben

• Designing, tuning and maintaining detection rules and analytics.
• Leading threat hunting activities and translating threat intel into detections.
• Identifying detection gaps and driving improvements across detection capability.
• Developing automation, SOAR playbooks and response workflows.
• Acting as tactical responder for significant cyber incidents and on-call duties.

Kenntnisse

Detection engineering

Threat hunting

Incident response

Security leadership

Ausbildung

GCDA/GCIA/GCIH certifications

Tools

SIEM

XDR

EDR

Jobbeschreibung

Own threat detection and support cyber incident responseLead threat hunting and develop intelligence-led detectionsShape security automation and support major incident responseTe Whiwhinga mahi | The opportunityWe're looking for three Principal Engineers, Detection and Response to strengthen NZ Transport Agency | Waka Kotahi (NZTA)'s cyber defence capability through advanced threat detection, threat hunting and incident response.This is a senior technical role that combines hands-on detection engineering, technical leadership and tactical cyber incident response. Working across SIEM, XDR and EDR platforms, you'll improve detection coverage, reduce time to detect threats and help protect critical services from cyber risk.Key responsibilities include:Designing, tuning and maintaining detection rules, correlation logic and behavioural analyticsLeading threat hunting activities and translating threat intelligence into actionable detection contentIdentifying detection coverage gaps and driving continuous improvement across the detection capabilityDeveloping automation, SOAR playbooks and response workflows to improve security operationsSetting quality standards and validating detection content before deploymentProviding specialist expertise for security tool and platform evaluationsActing as a tactical responder for significant cyber incidents, supporting containment, eradication and recovery activities.This role participates in a 24/7 on-call roster and plays a critical part in maintaining NZTA's cyber resilience.You will find out more about the role here Position DescriptionKo koe tenei | About youYou bring strong detection engineering experience, sound judgement in complex situations and the ability to influence technical outcomes without formal people leadership. Comfortable making incident response decisions within delegated authority, you combine practical expertise with a continuous learning mindset. We value practical achievements, transferable skills and potential, so you don't need to meet every requirement.You'll bring:Strong experience designing, tuning and managing detection rules, correlation logic or behavioural analytics across SIEM, XDR or EDR platformsExperience investigating suspicious activity and hunting threats using telemetry and threat intelligence, applying sound judgement when information is incompleteAn evidence-based approach to identifying detection gaps and turning threat insights into practical improvements, with familiarity with MITRE ATT&CK beneficialExperience using automation or scripting to improve security workflows, with an understanding of testing, assurance and safe deployment. SOAR experience is advantageousThe ability to provide technical guidance, review detection content and strengthen detection and response practices through lessons learnedAn understanding of security and privacy obligations, with a willingness to develop knowledge of NZISM and New Zealand public sector requirementsRelevant experience, qualifications, or a combination of both. Certifications such as GCDA, GCIA or GCIH are advantageousThe ability to obtain and maintain a New Zealand national security clearance up to and including SECRETYou will demonstrate knowledge of, or a willingness to gain an understanding of Te Ao Maori and promote tikanga and Te Reo Maori. You will also have knowledge of, or a willingness to gain an appreciation of Te Tiriti o Waitangi (the Treaty of Waitangi) as it applies in the public service.Mo matou | About usAt NZTA, we deliver transport networks that connect people, places and New Zealand. Te Aukaha | Digital provides the technology and information services that enable better outcomes for our customers, partners and people.Within Digital, Security protects NZTA's people, information and technology through resilient operations, assurance, governance and secure-by-design practices.As part of Security Operations and Resiliency, you'll help strengthen NZTA's 24/7 detection and response capability, working across threat detection, incident response and cyber resilience. You'll collaborate closely with security operations, threat intelligence, engineering and governance teams, as well as external cyber security partners and vendors.Ka whiwhi koe i te aha | What you will get in returnThis is an opportunity to shape a specialist security capability with a clear public purpose. You'll combine hands-on detection engineering and tactical incident response with influence over detection quality and reliability, automation and platform decisions, helping strengthen the systems that support transport outcomes for New Zealand.Work alongside security specialists and partners to turn threat insights and operational learning into practical improvements.Contribute within a culture grounded in having heart, working better together, being brave and delivering meaningful outcomes.In addition, you'll benefit from:Flexible working arrangements that support work-life balanceFive weeks annual leaveIncome Protection and Critical Illness Insurance for permanent employeesProfessional development and career growth opportunitiesA collaborative and inclusive culture committed to delivering meaningful outcomes for New ZealandersReady to help strengthen our detection and response capability?If you're ready to bring your detection engineering expertise and tactical response judgement to work with a clear public purpose, we'd love to hear from you.Me pehea te tuku tono | How to apply:Please click apply to upload your CV and cover letter detailing your suitability for the role.Ra Katinga | Applications close:15 November 2026For further information, email: [e-mail] be considered for this position you must have a legal right to live and work in New Zealand.NZTA| Waka Kotahi is an equal opportunity employer (EOE). We recognise the importance of diversity and inclusion and are committed to providing a working environment that embraces these values. Please let us know if you need any support or have any access requirements that will help you through the recruitment process.Please note that we may begin shortlisting as we receive applications. We encourage early applications as we may withdraw the advertising at any time.