Lead Cyber Threat Analyst

About the role

A major Federal Government cyber security team supporting critical systems and services is looking for an experienced Lead Cyber Threat Analyst in Canberra. The role leads threat hunting, cyber investigations, incident response and intelligence-led security operations in a complex enterprise environment, on a 12-month contract with potential extensions.

Key responsibilities

• Lead proactive cyber threat hunting across enterprise environments
• Investigate cyber security incidents, intrusions and suspicious activity
• Analyse emerging threats, adversary behaviour and attack patterns
• Support and lead incident response, including containment, investigation and reporting
• Develop threat intelligence products, threat models and risk assessments
• Analyse vulnerabilities, identify security gaps and recommend remediation
• Collaborate with cyber operations, threat intelligence, engineering and security teams
• Mentor team members and contribute to capability uplift initiatives
• Produce reports and briefings for technical and non-technical stakeholders

Required profile

• Extensive experience in cyber threat hunting and threat analysis
• Strong incident response and cyber investigation experience
• Experience in large enterprise or government cyber security environments
• Knowledge of PSPF, ISM, Essential Eight and NIST security frameworks
• Australian citizen able to obtain or hold an NV1 security clearance

Required skills

• Microsoft Defender XDR and advanced hunting with KQL
• SIEM platforms such as Microsoft Sentinel, QRadar or Elastic
• Threat intelligence and threat modelling
• Desirable: malware analysis, digital forensics, SOAR, vulnerability management tools, Active Directory, Microsoft Entra ID, cloud security, PowerShell and Python scripting

What we offer

• Initial 12-month contract with potential extensions up to 24 months
• Hybrid working arrangements
• Work on high-impact cyber security initiatives and exposure to advanced threat hunting and incident response technologies

Applications close 13 October 2026. Include an updated CV, security clearance status, availability and daily rate expectations.