Cyber Threat Intelligence (CTI) Detection Engineer

About this role

*Employment Type:*Ongoing

Classification: Parliamentary Executive Level 1

Contact: Brendon McKinley, (02) 6277 2828, brendon.mckinley@aph.gov.au

The Opportunity*

The Department of Parliamentary Services (DPS) supports the operation of the Australian Parliament by providing secure, reliable and effective ICT services across Australian Parliament House (APH). Within the Information Services Division, the Cyber Security Branch protects DPS and APH systems, information and users from cyber security threats through governance, assurance, engineering, monitoring, detection and response activities.

The role sits within the Cyber Security Operations Centre (CSOC), which is responsible for monitoring, detecting and responding to cyber security events and incidents across DPS-supported APH environments. CSOC operates in a high-tempo and nationally significant context, supporting the security and continuity of parliamentary services by turning security telemetry, threat intelligence and operational findings into practical protective outcomes.

As the Assistant Director Detection Engineering and Technical CTI, you will lead and manage the CSOC detection lifecycle management process. This includes identifying detection gaps, developing and testing detection hypotheses, deploying and tuning analytics, maintaining technical cyber threat intelligence workflows, and ensuring detections remain current, effective and actionable as adversary tactics, techniques and procedures evolve.

The role works closely with CSOC analysts, cyber engineering, Cyber Hunt and Threat Emulation (CHATE), Cyber Intelligence and Assurance, system owners, service providers and senior stakeholders. It provides expert technical advice on detection coverage, logging requirements, telemetry gaps, alert quality, response guidance and practical uplift options that improve DPS’s ability to detect and respond to cyber security threats.

This is a unique opportunity to shape an intelligence-led detection engineering capability in a critical national institution. The successful candidate will help connect technical cyber threat intelligence with real-world monitoring and response.

Who we are looking for*

We are looking for a technically strong, analytical and outcomes-focused cyber security professional who can translate intelligence, incident findings and adversary tradecraft into practical detection and response improvements. The ideal candidate will be comfortable working with ambiguity, prioritising competing operational demands, and producing clear, evidence-based advice for both technical and non-technical audiences.

The successful candidate will demonstrate

• experience leading or contributing to detection engineering, detection lifecycle management, security monitoring or cyber security operations in a complex enterprise environment;
• the ability to convert cyber threat intelligence, adversary tactics, incident lessons, vulnerability information and threat hunting outcomes into practical detection logic, alerting, response guidance and measurable uplift;
• strong technical knowledge of security telemetry, logging, SIEM, SOAR, endpoint detection and response, cloud security monitoring and cyber threat intelligence platforms;
• sound analytical and problem-solving skills, including the ability to assess detection effectiveness, reduce false positives, identify missed detection opportunities and provide evidence-based recommendations;
• well-developed communication, stakeholder engagement and documentation skills, including the ability to brief technical and non-technical audiences and negotiate practical outcomes with system owners and service providers;
• a collaborative, curious and improvement-focused approach, with the judgement to balance operational urgency, cyber risk and business impact.

Relevant qualifications or demonstrated equivalent experience in cyber security, information technology, computer science, intelligence, security operations or a related discipline are required. Desirable experience includes working with SIEM and SOAR platforms, endpoint detection and response, cloud security monitoring, cyber threat intelligence platforms, MITRE ATT&CK, structured threat intelligence standards and Australian Government cyber security frameworks including the ISM and PSPF.

Job Specific Requirements

• The successful applicant will be required to obtain and maintain a Negative Vetting 1 (Confidential/Highly Protected/Secret) security clearance.

At DPS, we are committed to building a diverse and inclusive workplace that ensures all our people can contribute to our shared purpose. We encourage applications from Aboriginal and Torres Strait Islander people, people with disability, people with caring responsibilities, people who identify as LGBTQIA+, people from cultural and linguistically diverse backgrounds, people who identify as neurodivergent, and mature aged people.

Duty Statement*

*Classification:*Parliamentary Executive Level 1

*Branch:*Cyber Security

*Section:*Cyber Security Operations

*Immediate supervisor:*Director, Cyber Security Operations

Duty Statement

Under limited/general direction undertake duties in accordance with the agreed standards for the specified classification. The duties will include, but are not limited to, the following:

1. Lead and manage the CSOC Detection Lifecycle Management process, including the identification, prioritisation, development, testing, deployment, tuning, health monitoring and retirement of cyber security detections across DPS and APH environments.

2. Translate cyber threat intelligence, incident findings, vulnerability information, threat hunting outcomes and adversary tactics, techniques and procedures into actionable detection hypotheses, analytics, alert logic, response guidance and playbooks.

3. Develop, maintain and assure technical CTI products, systems and workflows that support CSOC monitoring, detection and response, including indicator management, enrichment processes and intelligence-led detection engineering.

4. Provide expert technical advice to CSOC analysts, cyber engineering, cyber intelligence, CHATE, system owners, service providers and senior stakeholders on detection coverage, logging requirements, telemetry gaps, detection health, alert quality and practical uplift options.

5. Prepare clear, evidence-based technical reports, briefs, detection documentation, assurance artefacts and recommendations that communicate cyber risk, operational impact, detection effectiveness, known limitations and remediation priorities to technical and non-technical audiences.

6. Contribute to the continual uplift of CSOC capability by developing frameworks, procedures, quality assurance practices, metrics, tooling, automation and stakeholder engagement approaches aligned to DPS cyber security objectives, the CSOC Charter, the Cyber Security Incident Response Plan, the System Logging and Audit Plan, the ISM and the PSPF.

Selection Criteria*

1. Demonstrated experience leading or contributing to detection engineering, detection lifecycle management, security monitoring or cyber security operations in a complex enterprise environment, including the development, testing, tuning and sustainment of detections.

2. Demonstrated ability to convert cyber threat intelligence, adversary tradecraft, incident lessons, vulnerability information and threat hunting outcomes into practical detection logic, alerting, response guidance and measurable improvements to cyber security operations.

3. Strong technical knowledge of security telemetry, logging, SIEM, SOAR, endpoint detection and response, cloud security monitoring and cyber threat intelligence platforms, including the ability to identify data source requirements and resolve detection gaps.

4.

About intelligence & analysis roles for ex-police

Intelligence analyst and researcher roles in corporates, consultancies and government, including at agencies like ACIC. Source evaluation, criminal-intelligence discipline and analytical products give ex-officers a running start.