CyberCX - Security Analyst

We’re looking for a Security Analyst to join our Managed Security Services team in Melbourne, supporting a portfolio of enterprise customer environments across security monitoring, incident investigation, detection improvement and threat hunting.

This is a hands-on security operations role suited to someone with practical SOC or security operations experience who wants to continue building their capability across a variety of customer environments.

You’ll work alongside experienced Senior Analysts and Technical Leads, gaining exposure to complex investigations, customer-specific security challenges and a broad range of technologies.

What you’ll be doing

• Monitor and investigate security alerts across enterprise customer environments

• Analyse security events using SIEM platforms such as Microsoft Sentinel and Splunk

• Investigate suspicious activity across identity, cloud, endpoint and network telemetry

• Support incident response activities including investigation, scoping, containment and escalation

• Work with technologies including Microsoft Defender, CrowdStrike and Cortex XDR

• Tune existing detections and help reduce false positives and alert noise

• Assist with the development of new detections and customer-specific security use cases

• Participate in threat hunting activities based on threat intelligence, customer concerns or identified indicators

• Identify gaps in logging, detections and security visibility

• Support vulnerability management activities, including reviewing and prioritising findings

• Communicate security findings and recommendations clearly to customers and internal stakeholders

• Contribute to automation, process improvement and broader SOC capability development

• Work closely with Senior Analysts and Technical Leads on complex investigations and escalations

• Participate in the team’s rotating on-call roster for after-hours escalations

What you’ll bring

• Practical experience working in a SOC, MSSP, MDR or security operations environment

• Hands-on experience investigating security alerts and incidents

• Experience with a SIEM such as Microsoft Sentinel, Splunk or a comparable platform

• Exposure to EDR/XDR platforms such as Microsoft Defender, CrowdStrike or Cortex XDR

• Understanding of common identity and account compromise scenarios

• Exposure to Microsoft Azure, Entra ID or broader cloud security environments

• An understanding of incident response and security investigation methodologies

• Experience analysing logs and correlating activity across multiple data sources

• Exposure to detection tuning, detection engineering or threat hunting

• A good understanding of common attacker behaviours and frameworks such as MITRE ATT&CK

• The ability to look beyond simply closing an alert and understand why it triggered, what happened, what may be affected and what action should be taken next

• The ability to connect technical findings to customer risk and communicate recommendations clearly

• Curiosity, sound judgement and a willingness to challenge assumptions and investigate beyond the obvious

• Strong written and verbal communication skills

• Experience with vulnerability management platforms such as Tenable or Qualys would be advantageous but is not essential.