Lead Detection Engineer (SIEM, SOAR and Automation)

Lead Detection Engineer (SIEM, SOAR and Automation)

Heartbeat
| where TimeGenerated > ago(24h)
| summarize LastSeen = max(TimeGenerated) by Computer
| where LastSeen < ago(1h)

If you’ve ever run something like this and found a log source had quietly stopped talking, you already know why telemetry health matters. This team needs someone who never wants to find out the hard way.

A large Australian organisation is looking for a Lead Detection Engineer to lead detection engineering, security automation and telemetry health across its hybrid SOC. Reporting to the SOC Manager, you’ll be the senior hands-on technical voice driving the move to an automated, agentic SOC.

What you’ll be doing

• Leading detection engineering, rule tuning and continuous mapping to MITRE ATT&CK
• Designing, building and refining SOAR workflows and automated incident response playbooks
• Monitoring, baselining and auditing log pipelines, so there are no blind spots
• Building API integrations and telemetry connectors across the security stack
• Turning threat intelligence into proactive hunts, and piloting agentic SOC workflows
• Acting as the technical quality lead for the managed provider, validating escalations and driving detection improvements
• Leading root cause analysis, threat modelling and post-incident engineering improvements

What you’ll bring

• Extensive cyber security experience in a large enterprise environment
• Strong hands-on experience across detection engineering, SOAR, SIEM and EDR
• Experience with API integrations, data parsing and log pipeline health
• A strong understanding of adversary TTPs and MITRE ATT&CK
• Experience working with managed security providers in a hybrid SOC
• Bonus points for Python, API orchestration or agentic security workflows, and certifications such as GCDA, GCTI or GCSA

The practical bits

• Permanent, full time
• Hybrid, Sydney

Got a detection or automation you’re quietly proud of? I’d love to hear about it.