Detection Engineer / Security Analyst – Managed SIEM (Splunk)

About the role

Join a 15‑year‑old managed SIEM service delivering Splunk Enterprise Security for Australian clients. You will split your time between detection engineering, configuration hardening, threat hunting and maintaining the underlying ISMS and infrastructure.

Key responsibilities

• Onboard and normalise client data sources, write SPL transforms and detection content mapped to ATT&CK.
• Tri­age notable events against SLAs, decide on maliciousness and defend your decisions.
• Maintain Splunk health on Linux in AWS, diagnose ingestion faults for logs such as CloudTrail, CrowdStrike Falcon, M365 and Azure.
• Review client M365, Entra ID, Windows and AWS configurations against CIS Benchmarks and the Essential Eight, providing evidence‑based findings.

Required profile

• At least 3 years of hands‑on experience in infosec, SIEM, SOC, MSSP or security engineering.
• Strong ability to read and interpret Windows security event logs and treat Active Directory as an attack surface from day one.

Required skills

• Splunk (SPL) – preferred, with knowledge of Sentinel, Elastic or QRadar as alternatives.
• AWS, Linux command line, Bash, PowerShell or Python scripting.
• Windows security event logs, Active Directory, Entra ID, Azure activity logs and RBAC.
• CloudTrail, CrowdStrike Falcon, Microsoft 365, CIS Benchmarks, ATT&CK framework, ISO 27001.

What we offer

• Salary package of AUD 130,000–160,000 reviewed annually.
• Sponsored certifications (Splunk, AWS, CrowdStrike, SC‑200, BSCP, ISO 27001) with study time during work hours.
• Hybrid working after probation and participation in a shared on‑call roster.
• Direct reporting to the director in a small specialist team serving long‑term clients.