Cyber Incident Response Lead

Your new company 
A leading Victorian State Government agency is seeking an experienced Cyber Incident Response Analyst to join its Information Security Services Branch, safeguarding one of the state's largest technology environments. You'll join a collaborative, forward-thinking team driving security uplift and operational resilience.


Your new role 

• Lead end-to-end detection, triage, containment and recovery of cyber incidents in line with the department's Cyber Security Incident Response Plan (CSIRP).
• Conduct Level 2/3 investigations and threat hunting using Microsoft Sentinel, Splunk, Defender and EDR tools.
• Perform daily SOC monitoring, alert triage and escalation, correlating threat intelligence across platforms to identify emerging threats.
• Build and enhance Sentinel detection engineering, including analytics rules, MITRE ATT&CK mapping, workbooks, playbooks and automation, and improve SOC processes.
• Deliver situation reports, post-incident reviews, RCA reports, security metrics and executive briefings.
• Provide expert advice on Microsoft Sentinel, Defender, Google Security, Tenable and ServiceNow.
• Partner with ICT and school technical teams, service providers and Victorian Government cyber agencies to strengthen security posture.

• Proven experience leading cyber incident response, including CSIRT, crisis management, containment, recovery and post-incident review.
• Strong SOC background across monitoring, alert investigation, threat intelligence, threat hunting and SIEM/EDR platforms.
• Deep expertise in Microsoft Sentinel and Defender, including advanced KQL.
• Hands-on detection engineering: log management, analytics rule tuning, workbooks, playbooks, automation and use cases.
• Sound knowledge of NIST CSF, MITRE ATT&CK, ASD Essential Eight and incident response frameworks.
• Vulnerability and risk management experience, with the ability to advise technical and non-technical stakeholders.
• Excellent communication and report-writing skills (RCA reports, incident summaries, executive briefings), with confidence engaging senior executives.
• Strong analytical and problem-solving skills, with the ability to prioritise complex incidents under pressure.
• Tertiary qualifications in Cyber Security, IT or a related field, plus industry-recognised certifications.

• Lead a strategic, high-visibility government initiative.
• Hybrid working and a supportive, collaborative culture.
• Competitive daily rate with extension potential.