search Browse Jobs
Senior Security Operations AnalystKPMG Australia · Melbourne, Victoria, Australia
KPMG Australia logo

KPMG Australia

company page ↗

Senior Security Operations Analyst

🗓️ Posted 2026-09-11 Melbourne, Victoria, Australia Full-time Hybrid ICT
💰 Salary Not shared 📊 Market A$8,333–A$12,500/mo

About the Company

Job Description Join our Security Operations Centre as a Senior Security Operations Analyst , where you will play a leading role in strengthening our detection capability and responding to complex cyber security incidents. With a primary focus on detection engineering, you will translate threat intelligence, hunting outcomes and incident findings into effective, tested and maintainable detection content across our SOC technology platforms. Your Opportunity As a senior cyber security practitioner, you will own the end-to-end lifecycle of detection content and provide Level 3 technical support to the SOC. You will act as the final escalation point for complex and high-severity incidents, while mentoring analysts and supporting the continuous improvement of our security operations capability.

Responsibilities

  • ● Detection engineering
  • ● Own the detection lifecycle, including requirements intake, research, development, testing, deployment, tuning and retirement.
  • ● Develop and maintain detection content across SIEM and XDR platforms, including analytics rules, correlation logic and custom queries.
  • ● Write and optimise advanced queries using technologies such as KQL in Microsoft Sentinel and Microsoft Defender XDR.
  • ● Apply detection-as-code practices, including version control, peer review, change management and automated testing.
  • ● Map detection coverage to the MITRE ATT&CK framework, identify gaps against prioritised threats and maintain a documented detection backlog.
  • ● Validate detections through adversary emulation, purple team exercises and controlled test scenarios before deployment to production.
  • ● Maintain clear documentation covering detection rationale, data dependencies, expected true-positive behaviour, triage guidance and response actions.
  • ● Measure and report detection performance using metrics such as alert volumes, precision, false-positive rates and time to detect.
  • ● Review, rewrite or retire detections that no longer provide value, including where platform, telemetry or environmental changes affect existing content.
  • ● Data, telemetry and platform enablement
  • ● Assess log-source coverage and data quality, and define onboarding requirements for new telemetry sources.
  • ● Develop and maintain parsers, data normalisation and schema alignment to support consistent and portable detection logic.
  • ● Partner with security engineering and platform teams to address gaps in logging, retention and telemetry fidelity.
  • ● Contribute to the configuration and optimisation of SIEM, SOAR and supporting SOC technologies, including ingestion cost management.
  • ● Build and maintain automation, enrichment and SOAR playbooks to improve triage consistency and reduce manual effort.
  • ● Level 3 security operations support
  • ● Act as the final technical escalation point for complex, ambiguous or high-severity incidents raised by Level 1 and Level 2 analysts.
  • ● Lead deep technical analysis across endpoint, identity, network and cloud evidence sources during major incidents.
  • ● Provide technical leadership across incident workstreams and support incident commanders with findings, timelines and containment options.