Security Operations Lead - Cyber Security

About the role

A growing cyber security function in Melbourne is looking for an experienced Security Operations Lead to take on a hands-on technical leadership role combining incident response, detection engineering and security operations leadership. Reporting to the Security Operations Manager, you will lead the Security Operations Centre and support 24x7 managed detection and response services, mentoring analysts and driving continuous improvement.

Key responsibilities

• Provide hands-on technical leadership across security operations and incident response.
• Lead complex Level 2 and Level 3 security incident investigations, escalations and response.
• Support the delivery and continuous improvement of 24x7 managed detection and response services.
• Develop, maintain and optimise detection capabilities across Microsoft Sentinel and Defender XDR.
• Create and refine KQL queries, detection rules and automated response workflows.
• Use SOAR and Azure Logic Apps to improve security operations and incident response.
• Mentor SOC analysts, give technical guidance and support operational coordination.
• Identify improvements to detection coverage, incident response processes and service performance.

Required profile

• Minimum five years of experience in cyber security or SOC operations.
• Previous experience as a Senior SOC Analyst, L3 Analyst or technical team leader.
• Experience in a 24x7 SOC or managed detection and response environment.
• Strong communication skills and ability to mentor analysts.

Required skills

• Deep knowledge of Microsoft Sentinel, Defender XDR, Entra ID and Azure security.
• Strong KQL skills and experience with SOAR, automation and Logic Apps.
• Working knowledge of MITRE ATT&CK, NIST incident response frameworks, Essential Eight and ISO 27001.
• Microsoft SC-200 certification required; SC-100 expected within three months.
• Certifications such as CISSP, GIAC or CISM highly regarded.