Senior Threat Detection & Incident Response Lead

NZ Transport Agency Waka Kotahi; Palmerston North; On-site; NZD 150,000 - 210,000; Full time

Benefits offered by this job

Flexible working arrangements

Five weeks annual leave

Income protection

Professional development

Collaborative culture

Job summary

NZ Transport Agency | Waka Kotahi (NZTA) is seeking three Principal Engineers, Detection and Response to strengthen its cyber defence through advanced threat detection, threat hunting and incident response.

This senior role combines hands-on detection engineering, technical leadership and tactical cyber incident response across SIEM, XDR and EDR platforms to improve detection coverage and protect critical services from cyber risk.

Qualifications

• Strong experience designing, tuning and maintaining detection rules across SIEM/XDR/EDR.
• Experience investigating suspicious activity and threat hunting using telemetry and threat intel.
• Familiarity with MITRE ATT&CK is beneficial.
• Automation or scripting to improve security workflows; SOAR experience advantageous.
• Ability to provide technical guidance and strengthen detection and response practices.

Responsibilities

• Design, tune and maintain detection rules, correlation logic and behavioural analytics.
• Lead threat hunting activities and translate threat intel into actionable content.
• Identify detection gaps and drive continuous improvement across detection capability.
• Develop automation, SOAR playbooks and response workflows for security operations.
• Act as a tactical responder for major cyber incidents and support containment.

Skills

detection engineering

threat hunting

incident response

automation

SOAR

SIEM/XDR/EDR

MITRE ATT&CK

Tools

SOAR

EDR platforms

XDR

SIEM tools

Job description

NZ Transport Agency | Waka Kotahi (NZTA) is seeking three Principal Engineers, Detection and Response to strengthen its cyber defence through advanced threat detection, threat hunting and incident response.

This senior role combines hands-on detection engineering, technical leadership and tactical cyber incident response across SIEM, XDR and EDR platforms to improve detection coverage and protect critical services from cyber risk.