Security Operations Centre Team Leader

If you're passionate about cyber security, thrive on solving complex threats, and enjoy developing high-performing teams, this is the perfect opportunity for you. As our SOC Team Lead, you'll combine hands-on technical expertise with leadership responsibility, playing a pivotal role in protecting our customers and business.

In this role, you'll lead from the front, acting as the senior technical authority for incident response, guiding Security Analysts through complex investigations, and driving operational excellence across the SOC. You'll have the opportunity to mentor and develop junior analysts, shape security processes, and continuously elevate the capability of the team.

Unlike purely managerial positions, you'll remain deeply involved in the technical work, dedicating part of your time to Level III SOC Analyst responsibilities. This means you'll be actively investigating sophisticated threats, responding to critical incidents, and working with cutting-edge security technologies alongside your team.

You'll enjoy a collaborative environment where your expertise is valued, your leadership makes a visible impact, and your contributions directly strengthen our security posture while helping others grow their careers in cyber security.

5+ years of hands-on experience in a Security Operations Centre (SOC) environment, with demonstrated experience in incident response.

Proven experience in a senior or lead analyst role, with a passion for mentoring others.

Deep technical expertise with core security technologies, including SIEM (e.g., Elastic SIEM, Splunk, Sentinel, QRadar), EDR, and network security tools.

Strong understanding of incident response methodologies, cyber kill chain, and frameworks like the MITRE ATT&CK® framework.

Excellent analytical, critical thinking, and problem-solving skills, with the ability to perform calmly under pressure.

Strong communication skills, capable of clearly explaining complex technical issues to team members.

Professional cybersecurity certifications such as GIAC (GCIH, GCFA), CISSP, OSCP etc.

Experience with scripting or automation (e.g., Python, PowerShell) to improve SOC efficiency.

Experience working in a Managed Security Service Provider (MSSP) environment.

Experience with security orchestration, automation, and response (SOAR) platforms.

Knowledge of cybersecurity standards related to incident response, such as NIST SP800-61r1, SP800-61r2, SANS PICERL, etc.

Exposure and good working knowledge supporting LANs/WLANs

Experience in operationalizing and developing SOC specific processes (procedures, work instructions, etc.).

Previous experience with raw log file review, data correlation, and analysis, as well as with network security tools, network traffic analysers, firewall logs, network flows, intrusion detection systems, system logs, memory dumps, vulnerability management, SOAR platforms, SIEM, especially Elastic SIEM, and other Enterprise / Open Source equivalents.

Previous experience in malware investigations, incident response, and threat hunting

We know that when our people are happy, they will work better and have greater work satisfaction. Here's what you can expect:

We're all different - and we love this about us.

We provide an inclusive, safe, and welcoming environment to all Civicans - there are heaps of opportunities to enable you to grow and be your best.

Giving culture - we encourage you to "give back" with benefits such as our Days of Difference leave where you can volunteer for a charity of your choice.

Flexible Work - we have comprehensive flexibility options including part-time work, adjusted hours, staggered shifts, and hybrid or remote working, supporting work–life balance based on individual needs.

Apply for this job - Become part of something special Do you see yourself in this role? If so, then we would love to hear from you.