search Browse Jobs
Senior Security Operations AnalystKPMG · Melbourne, VIC, au
KPMG logo

KPMG

company page ↗ Visa Sponsoring Company

Senior Security Operations Analyst

✓ This company has sponsored visas before. The posting doesn't say so, but it's still worth applying.

🗓️ Posted 2026-09-11 Melbourne, VIC, au Full-time Hybrid ICT
💰 Salary Not shared 📊 Market A$8,333–A$12,500/mo

About the Company

KPMG is a global professional services firm specializing in audit, tax, and advisory services. It operates in over 150 countries, serving clients in various industries. Professional Services Specialties: Audit, Tax Advisory, Management Consulting, Risk Management, Financial Advisory, Deals & Corporate Finance, Technology Consulting, Sustainability Services

About the Role

Join our Security Operations Centre as a Senior Security Operations Analyst, where you will play a leading role in strengthening our detection capability and responding to complex cyber security incidents. With a primary focus on detection engineering, you will translate threat intelligence, hunting outcomes and incident findings into effective, tested and maintainable detection content across our SOC technology platforms. As a senior cyber security practitioner, you will own the end-to-end lifecycle of detection content and provide Level 3 technical support to the SOC, acting as the final escalation point for complex and high-severity incidents, while mentoring analysts and supporting the continuous improvement of our security operations capability.

Responsibilities

  • ● Own the detection lifecycle, including requirements intake, research, development, testing, deployment, tuning and retirement.
  • ● Develop and maintain detection content across SIEM and XDR platforms, including analytics rules, correlation logic and custom queries.
  • ● Write and optimise advanced queries using technologies such as KQL in Microsoft Sentinel and Microsoft Defender XDR.
  • ● Apply detection-as-code practices, including version control, peer review, change management and automated testing.
  • ● Map detection coverage to the MITRE ATT&CK framework, identify gaps against prioritised threats and maintain a documented detection backlog.
  • ● Validate detections through adversary emulation, purple team exercises and controlled test scenarios before deployment to production.
  • ● Maintain clear documentation covering detection rationale, data dependencies, expected true-positive behaviour, triage guidance and response actions.
  • ● Measure and report detection performance using metrics such as alert volumes, precision, false-positive rates and time to detect.
  • ● Review, rewrite or retire detections that no longer provide value, including where platform, telemetry or environmental changes affect existing content.
  • ● Assess log-source coverage and data quality, and define onboarding requirements for new telemetry sources.
  • ● Develop and maintain parsers, data normalisation and schema alignment to support consistent and portable detection logic.
  • ● Partner with security engineering and platform teams to address gaps in logging, retention and telemetry fidelity.
  • ● Contribute to the configuration and optimisation of SIEM, SOAR and supporting SOC technologies, including ingestion cost management.
  • ● Build and maintain automation, enrichment and SOAR playbooks to improve triage consistency and reduce manual effort.
  • ● Act as the final technical escalation point for complex, ambiguous or high-severity incidents raised by Level 1 and Level 2 analysts.
  • ● Lead deep technical analysis across endpoint, identity, network and cloud evidence sources during major incidents.
  • ● Provide technical leadership across incident workstreams and support incident commanders with findings, timelines and containment options.
  • ● Conduct post-incident reviews, identify detection and response gaps, and translate findings into improved detection content.
  • ● Participate in escalation and on-call arrangements where required to support extended-hours coverage.
  • ● Translate threat intelligence into prioritised detection requirements aligned with the firm's threat profile.
  • ● Conduct structured, hypothesis-driven threat hunts across SIEM, endpoint, identity and cloud telemetry.
  • ● Convert threat-hunting findings into repeatable detection logic, automation and documented hunting queries.
  • ● Monitor adversary tradecraft, vulnerabilities and emerging threats, assessing their relevance and detection implications.
  • ● Mentor and coach Level 1 and Level 2 analysts in investigation techniques, query development and detection engineering concepts.
  • ● Peer review detec