Senior Security Engineer (Detection and Response)

About the role

REA Group is hiring a Senior Security Engineer in Detection and Response. The role works as an individual contributor, driving workstreams from problem definition through delivery and executing independently within agreed architecture and practices. It is a permanent position based in Melbourne or Sydney, also open to remote work in other Australian locations.

The Detection & Response team identifies, investigates and responds to cyber threats, monitors security signals, validates alerts, investigates suspicious activity and leads or supports incident response. The engineer will modernise detection capability by improving data flows, telemetry integrations and detection workflows, using AI-assisted tooling to develop, review and validate detections and response automations.

Key responsibilities

• Configure and operate data flows supporting the detection platform, including log forwarding, transformation and cost optimisation, working with Platform and Cloud teams on integration changes.
• Define the threats and behaviours to detect, then review, tune and validate high-fidelity detections and correlation logic.
• Develop and maintain automated detection testing and validation processes to catch configuration drift, regressions and coverage gaps.
• Analyse security events and logs to identify malicious activity, patterns and emerging attack techniques during investigations and threat hunting.
• Assess threat intelligence and emerging attack techniques and turn them into improved detection coverage and signal quality.
• Investigate alerts and incidents, coordinate technical containment and response, and communicate findings, actions and risks to the incident response team and stakeholders.
• Develop response playbooks and automation workflows, and partner with product, platform and engineering teams on logging, monitoring and detection coverage for new systems.
• Share knowledge with other Security and engineering teams through documentation, operational practices and continuous improvement.

Required profile

• Hands-on experience configuring and operating data flows such as log forwarding, data transformation, API integrations, cost-optimised ingestion and observability pipelines.
• Practical experience in cloud environments (AWS, GCP or Azure) and cloud and application architectures, logging, monitoring and native security controls.
• Experience defining threats to detect and validating high-fidelity detections through detection-engineering practices and repository workflows.
• Strong log analysis skills and working knowledge of scripting for security automation and SOAR workflows.
• Familiarity with modern DevOps practices including CI/CD pipelines and automated deployment of security tooling.

Required skills

• Security observability tooling: EDR, SIEM, CNAPP, SOAR and identity platforms
• Understanding of attacker techniques and frameworks such as MITRE ATT&CK
• Ability to build automation workflows and document procedures through playbooks, runbooks and detection test cases

What we offer

• A hybrid and flexible approach to working
• Flexible leave options, including birthday leave and additional leave
• Parental leave for primary and secondary carers
• Hackdays and a volunteering programme with community grants and matched payroll giving