New Job Opening: Senior Detection Engineer in Sydney

Job Description

Senior Detection Engineer (SIEM, KQL, Sigma)

title: Detection Engineer Who Writes Their Own Rules
status: stable
level: high
falsepositives:
- Analysts who only tune vendor defaults

If you’ve already spotted that this rule would never pass validation without a logsource and detection block, you’re exactly who we’re after.

A large Australian organisation is building out its security operations team under a new SOC Manager. They want a Senior Detection Engineer to turn threat intelligence into detections that fire on the right things, and stay quiet on the wrong ones.

What you’ll be doing

• Designing, building, testing and tuning detections across SIEM and EDR


• Running detections as code, with version control, testing and CI/CD


• Mapping coverage to MITRE ATT&CK and closing the gaps that matter most


• Cutting false positives with the managed security service provider, so every alert that lands means something


• Hypothesis-driven threat hunting, with the findings turned into new rules


• Onboarding new log sources and improving the quality of existing telemetry

What you’ll bring

• Hands-on experience writing detection content in KQL, SPL or similar


• Working knowledge of Sigma and ATT&CK mapping


• Experience validating detections through purple teaming or tools like Atomic Red Team


• Python or PowerShell, plus Git and CI/CD habits


• SOAR exposure is a bonus

The practical bits

• Permanent, full time


• Hybrid, Sydney


• $160k to $180k base plus super


• Reports to the SOC Manager

Got a detection you’re quietly proud of? I’d love to hear about it.