Cyber Defense Analyst

About the role

Deloitte Australia's Cyber Defence team is looking for a senior technical Cyber Defense Analyst to lead cyber incident investigations and shape how detection engineering, SIEM integration and AI-assisted operations evolve. The role strengthens incident response, detection capability and AI-augmented cyber operations, and sits within the AU Cyber Defence Strategy and AI Cyber Strategy.

Key responsibilities

• Lead security incident investigations: technical analysis, scoping incidents, supporting containment decisions and giving leadership clear status updates during active investigations.
• Contribute to post-incident reviews, documenting root cause and remediation actions.
• Improve how incident response and SIEM work together: turn investigation findings into new or improved detection content, advise on detections, playbooks and log coverage, and help reduce manual effort and improve response speed.
• Work across SOAR automation and continuous improvement activities.
• Engage daily with Deloitte SIEM and global service partners, and keep runbooks, playbooks and operating procedures current and tested.
• Apply and trial AI and automation across triage, detection engineering and investigation support.
• Share experience through informal coaching to help less experienced team members grow.

Required profile

• Demonstrated experience investigating security incidents, including technical analysis and containment actions.
• Strong written and verbal communication, able to produce clear technical summaries for leadership.
• Experience with managed security service providers or global SOC and service delivery models.
• Familiarity with the MITRE ATT&CK framework and detection engineering methodologies.
• Exposure to AI/ML-enabled security tooling, or experience applying automation and AI to security operations.
• Understanding of AI and frontier AI risk concepts.

Required skills

• SIEM platforms such as Microsoft Sentinel, Splunk or equivalent, including detection engineering and SOAR automation.
• Certifications such as GCIH, GCFA, vendor-specific SIEM certifications, MITRE ATT&CK-based training or AI security fundamentals (preferred).

What we offer

• Flexible working options and several ways to work flexibly.
• Retail discounts, wellbeing leave and paid volunteering days.
• Parental leave and return-to-work support.
• Coaching and career growth opportunities.