Principal Incident Response Analyst

About this role

This Job is based in Australia

• Full time continuing role as Principal Incident Response Analyst
• Excellent salary package available
• Kensington, Sydney location, 2-3 days in the office, Hybrid working

About UNSW

UNSW isn’t like other places you’ve worked. Yes, we’re a large organisation with a diverse and talented community; a community doing extraordinary things. Together, we are driven to be thoughtful, practical, and purposeful in all we do. Taking this combined approach is what makes our work matter. It’s the reason we’re one of the top 20 universities in the world (QS top 20) and a member of Australia’s prestigious Group of Eight. If you want a career where you can thrive, be challenged and do meaningful work, you’re in the right place.

With a significant uplift across our Cyber teams, the Principal Incident Response Analyst will serve as a senior technical authority within the UNSW CSIRT team, providing expertise across incident response, digital forensics, threat intelligence and threat hunting. The role will lead response to complex and high-impact cyber security incidents following recognised frameworks and methodologies, while working closely with internal stakeholders and external partners, including MSSPs. The role reports to the Manager, Cyber Security Incident Response and has no direct reports.

Specific Accountabilities For This Role Include

• Serve as the primary technical contact for cyber security incidents impacting UNSW, coordinating response activities with operational teams, and keeping key stakeholders informed of critical developments.
• Conduct and lead advanced technical investigations into complex security incidents, utilising in depth expertise in digital forensics, malware analysis, and network analysis to identify root causes, trace threat actor activities, and contain threats.
• Provide expert guidance and technical oversight to the CSIRT team in delivering advanced incident response, threat hunting, threat intelligence, and digital forensics services.
• Drive the development, enhancement, and continuous refinement of incident response processes, ensuring they are robust, technically precise, and aligned with industry best practices. Leverage AI, machine learning, and cutting-edge technologies to enhance our capabilities.
• Facilitate technical collaboration between internal UNSW teams and external MSSP partners, ensuring the alignment of threat detection, analysis, and response activities to maintain an integrated and efficient incident response capability.
• Document and report on critical incidents, producing in-depth technical post-incident review (PIR) reports that detail the root cause, attack vectors, impacted infrastructure, and actions taken.
• Ensure reports align with established processes, standards, and frameworks, providing comprehensive insights and recommendations.
• Prepare and deliver strategic security reports, analysing trends, patterns, and insights to provide actionable recommendations that strengthen the organisation’s security posture, and sharing findings with relevant stakeholders
• Proactively analyse and apply cyber threat intelligence to strengthen organisational defences, supporting mitigation of cyber threats targeting the organisation.
• Lead the generation and refinement of actionable threat intelligence, analysing data from internal and external sources to identify emerging threats, attack trends, and adversary behaviours.
• Integrate intelligence into playbooks, operating procedures, and the knowledge base to enhance our security capabilities.
• Conduct proactive threat hunting to detect malicious actors and anomalies, leveraging advanced analytical techniques to uncover potential security threats in real time.
• Contribute to the development, implementation, and optimisation of security controls, services, and technologies to mitigate risks working closely with the Security Engineering team
• Adhere to IT Service Management practices across UNSW IT, Faculties, Divisions, and Affiliates
• Oversee and finalise effective communications with key stakeholders, both internal and external and provide influential input with stakeholders to achieve business outcomes.
• Align with and actively demonstrate the Code of Conduct and Values
• Ensure hazards and risks psychosocial and physical are identified and controlled for tasks, projects, and activities that pose a health and safety risk within your area of responsibility.

Who You Are

• A relevant tertiary qualification with extensive experience or equivalent competence gained through any combination of education, training, and experience.
• Minimum ten years of industry experience in cyber security incident response, with a minimum five years of management experience in a cyber security environment or in a senior support role.
• Strong technical skills and operational experience in the management, configuration, and support of security controls including network security, endpoint security, application security, data protection, and/or identity and access management.
• Comprehensive analytical and problem-solving skills and proven capacity to exercise initiative, flexibility and to be proactive in the development of robust solutions to problems.
• Strong consultation, influencing and negotiation skills and proven ability to engage effectively with diverse stakeholders to achieve successful outcomes.
• Strong written and verbal communication skills, with a high level of attention to detail for deliverables produced.
• Demonstrated success working effectively and collaboratively on initiatives with a range of people at different levels within an organisation.
• Excellent time management skills, with a demonstrated ability to respond to changing priorities, manage multiple tasks and meet competing deadlines by using judgement and initiative.
• An understanding of and commitment to UNSW’s aims, objectives and values in action, together with relevant policies and guidelines.
• Knowledge of health & safety (psychosocial and physical) responsibilities and commitment to attending relevant health and safety training.
• Relevant industry certifications such as GCFA, GREM, OSCP and CCSP are highly desirable but not required.

Benefits and Culture

• Flexible Working Options (work from home, flexible hours etc)
• Career development opportunities
• 17% Superannuation contributions and additional leave loading payments
• Additional 3 days of leave over Christmas period
• Discounts and entitlements (retail, education, fitness)

For further details on the benefits, please visit https://www.jobs.unsw.edu.au/lifestyle-benefits

To apply:  Please submit your CV, Cover Letter and responses addressing the required Who you are criteria.

Please note: Sponsorship is not available for this role; valid Australian working rights are required on application.

*Pre-Employment Checks*As part of our recruitment process candidates may be required to undergo pre-employment screening, which may include reference checks, qualification verification, right-to-work verification, and criminal history screening where relevant to the role.

Contact: Jen MacLachlan - Talent Acquisition Partner.

e: j.maclachlan@unsw.edu.au

Please apply through the application portal as we do not accept direct applications to the email above.

Applications close: Sunday 13th of September at 11.30pm

UNSW is committed to equity diversity and inclusion. Applications from women, people of culturally and linguistically diverse backgrounds, those living with disabilities, members of the LGBTIQ+ community; and people of Aboriginal and Torres Strait Islander descent, are encouraged. UNSW provides workplace adjustments for people with disability, and access to flexible work options for eligible staff.

About cyber security & digital forensics roles for ex-police

Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.