Lead Cyber Incident Responder – Government (Canberra, Brisbane, Melbourne, Sydney)

About the role

This position supports a federal government department across Canberra, Brisbane, Melbourne and Sydney. The Lead Cyber Incident Responder will manage end‑to‑end cyber security incidents, improve the department’s security posture and work within a hybrid environment on a 12‑month fixed‑term contract (extendable up to 24 months). NV1 security clearance is mandatory.

Key responsibilities

• Investigate and respond to potential and actual cyber security incidents throughout the full incident response lifecycle.
• Use Microsoft security tools to detect, analyse, and contain threats.
• Drive incident communications, ensuring all stakeholders are informed of status and required actions.
• Document technical findings, recommendations and maintain incident records.
• Facilitate recovery activities and conduct post‑incident reviews.
• Develop, test and maintain the cyber incident management policy and procedures in line with regulatory requirements.
• Identify technical improvements such as alert tuning and optimise response processes.

Required profile

• Hands‑on technical cyber incident response experience from end‑to‑end.
• Strong verbal and written communication skills for both technical and non‑technical audiences.
• NV1 security clearance.
• GIAC certifications (GCIH, GCFA) and relevant Microsoft security certifications.

Required skills

• Microsoft security tools
• Cyber incident response