Senior Incident Responder

Job Description

Senior Incident Responder (Cyber Security)

T1486.

If your stomach just dropped a little, you’ve probably been in the room when it happened for real. That’s exactly who we’re after.

A large Australian organisation is building out its security operations team under a new SOC Manager. They need a Senior Incident Responder who has run live P1s from first alert to stand-down. Tabletops are great, but this role needs someone who has done the real thing.

What you’ll be doing

• Leading the technical response to cyber incidents, from triage and containment through to recovery and the post-incident review
• Acting as lead investigator across endpoint, network, identity and cloud
• Holding a managed security service provider to account on escalations, performance and monthly reporting
• Writing the playbooks and running the tabletops, so each incident goes better than the last
• Threat hunting when things are (relatively) quiet

What you’ll bring

• Senior, hands-on incident response experience, including live P1s such as ransomware or BEC
• Forensic and investigation skills across endpoint, memory and logs
• Hands-on SIEM and EDR experience (Sentinel, Defender, Splunk, CrowdStrike or similar)
• Experience managing a third-party security provider, and clear views on what good reporting looks like
• A calm head at 3am, and the ability to explain what’s going on to senior leaders who aren’t technical

The practical bits

• Permanent, full time
• Hybrid, Sydney
• $160k to $180k base plus super
• Reports to the SOC Manager

Walked a P1 from detection to stand-down recently? Let’s talk.