Principal Security Operations Center Analyst

Role overview Lead complex security investigations for an Australia-based security operations team and serve as its senior technical reference. The work spans incident response, digital forensics, malware analysis, detection and workflow improvements, and coaching analysts. You’ll also partner with product and engineering teams to turn investigation lessons into stronger tools and processes.

Responsibilities - Lead multi-host investigations from initial triage through forensic timelines, root-cause analysis, and remediation across endpoint, identity, and SIEM data. - Research attacker techniques and malware, conduct static and dynamic analysis, and communicate findings through written research and public presentations. - Work with product and detection teams to convert recurring investigation challenges into durable product improvements, detections, and suppressions. - Build and maintain automation and agent-assisted workflows, with quality checks incorporated into how work runs. - Review investigation and agent output, identify the causes of misses, and provide final technical review for detection changes and significant incident reports. - Set investigation standards, mentor analysts, run case reviews and knowledge sessions, and explain threat activity and business risk to varied audiences.

Requirements - Six or more years in SOC, incident response, digital forensics and incident response, or managed detection and response, including leadership of multi-host investigations. - Deep knowledge of attacker behavior and detection across MITRE ATT&CK techniques, including credential access, lateral movement, persistence, and defense evasion. - Forensic investigation experience across Windows, macOS, and Linux. - Experience investigating and remediating cloud identity incidents in Microsoft 365/Entra ID and Google Workspace. - Advanced malware analysis skills, including extracting indicators of compromise and assessing malware capabilities and intent. - Strong Windows administration, networking, technical leadership, and mentoring skills; ability to communicate complex findings clearly. - Practical experience using AI tools and building automation or agent workflows, with sound judgment in checking their results and embedding quality controls.

Nice to have - Published security research, blog posts, conference talks, or open-source security tools. - Detection engineering and SIEM query experience; investigations in Azure, AWS, or GCP; or MSP, MSSP, MDR, and RMM experience.

Benefits and work setup - Fully remote work in Australia, Monday to Friday, with at least one annual trip to the United States and additional local events. - Base salary of AUD 180,000–215,000, plus bonus and equity. - Home-office setup reimbursement, monthly phone, internet, and equipment stipends, subsidised private health insurance, and stock options for full-time employees. - Twelve weeks of paid parental leave for primary and secondary carers, plus access to coaching and development support.