Staff Security Engineer (Detection and Response)

About the role

REA Group is hiring a Staff Security Engineer for its Detection & Response team, which identifies, investigates and responds to cyber threats across the organisation. The role provides technical accountability for the detection-engineering capability within a purpose-built detection platform, shaping standards, technical direction and the capability model across data flows, detection requirements, testing and response automation. It is a permanent position based onsite in Melbourne or Sydney, also open to remote work in other locations.

Key responsibilities

• Lead long-term, cross-team initiatives that strengthen detection and response, working with Product, Platform and Engineering teams
• Configure and operate the detection platform and its data flows, including log ingestion, transformation, alert enrichment and response automation
• Define detection patterns and tune high-fidelity detections and correlation logic to reduce false positives and improve coverage
• Build and maintain automated pipelines, infrastructure, tests and quality gates
• Analyse security events and logs, assess threat intelligence and frameworks, and investigate alerts and incidents
• Produce and automate response playbooks, and contribute to purple-team exercises and security testing
• Ensure new systems have appropriate logging, monitoring and detection coverage, and evaluate emerging tooling such as AI-assisted detection
• Mentor colleagues through reviews, pairing and internal forums

Required profile

• Ability to define detection engineering architectures, patterns and standards across multiple platforms
• Strong understanding of cloud and application architectures, including logging, monitoring and native security controls
• Deep knowledge of attacker techniques and kill-chain concepts (e.g. MITRE ATT&CK)
• Understanding of modern DevOps and systems-engineering practices, including detection-as-code, infrastructure-as-code and CI/CD pipelines

Required skills

• Log analysis, scripting and query languages
• Data pipelines, including log forwarding and transformation
• Security observability tooling: EDR, SIEM, CNAPP, SOAR and identity platforms
• Automation workflows for security operations and response orchestration

What we offer

• A hybrid and flexible approach to working
• Flexible leave options, including birthday leave and additional leave
• Parental leave for primary and secondary carers
• Hackdays and a volunteering programme