Senior Detection & Response Engineer - Threat Hunting & Automation Lead

Marketplace; Wellington; Hybrid; NZD 150,000 - 190,000; Full time

Benefits offered by this job

Flexible work arrangements

Five weeks annual leave

Income Protection and Critical Illness

Professional development

Collaborative culture

Job summary

New Zealand Transport Agency (NZTA) is seeking a Principal Detection and Response Engineer to strengthen its cyber defence through advanced threat detection, threat hunting and incident response. You will work across SIEM, XDR and EDR, designing detection content and leading on-call incident handling to protect critical transport services.

The role combines hands-on engineering, technical leadership, and 24/7 on-call availability in a fast-paced security operations environment.

Qualifications

• Design, tune and maintain detection rules across SIEM/XDR/EDR.
• Lead threat hunting and translate threat intel into detections.
• Identify gaps and drive continuous improvement in detection coverage.

Responsibilities

• Design, tuning and maintaining detection rules, correlation logic and behavioral analytics.
• Lead threat hunting and translate threat intelligence into actionable content.
• Identify detection coverage gaps and drive improvements across the capability.
• Develop automation, SOAR playbooks and response workflows.
• Provide specialist expertise for security tool evaluations.
• Act as tactical responder for significant cyber incidents.

Skills

Detection engineering

Threat hunting

Incident response

Automation

SOAR playbooks

Technical leadership

Tools

SIEM

XDR

EDR

Job description

New Zealand Transport Agency (NZTA) is seeking a Principal Detection and Response Engineer to strengthen its cyber defence through advanced threat detection, threat hunting and incident response. You will work across SIEM, XDR and EDR, designing detection content and leading on-call incident handling to protect critical transport services.

The role combines hands-on engineering, technical leadership, and 24/7 on-call availability in a fast-paced security operations environment.