Senior Detection Engineering & Threat Hunting Analyst

Role overview Help a security operations team find and disrupt stealthy threats by turning intelligence and investigative leads into reliable detections. The role combines detection engineering with large-scale threat hunting across endpoint and identity data, working alongside analysts who investigate alerts and incidents.

Responsibilities - Build, test, monitor, tune, and retire detection rules based on their effectiveness and accuracy. - Develop detections across endpoint, identity, and SIEM use cases, including Windows, Linux, and macOS environments. - Translate threat intelligence, indicators, adversary techniques, and investigation findings into detection logic through Git-based workflows. - Run hypothesis-led hunts, build queries and dashboards, and examine ambiguous activity for signs of intrusion. - Investigate or escalate likely incidents and communicate findings and practical guidance in clear reports. - Use AI-assisted workflows to support research and detection development, validating outputs before deployment.

Requirements - At least two years in detection engineering, threat hunting, a SOC, managed detection and response, or incident response. - Intermediate understanding of Windows internals and working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace. - Experience developing, testing, tuning, and documenting detections based on intelligence, hypotheses, or investigations. - Familiarity with detection formats such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL. - Understanding of attacker techniques, including persistence, privilege escalation, defense evasion, lateral movement, discovery, and collection. - Clear written communication and the ability to validate AI-generated analysis or detection content.

Nice to have - Linux or macOS internals, remote investigation tools such as osquery or Velociraptor, or endpoint forensics experience. - Malware analysis skills.

Benefits and work setup - Remote role based in Australia, with an annual US team gathering and local events. - Home office setup reimbursement, monthly phone and internet allowance, and equipment stipend. - Paid parental leave, subsidized private health insurance, stock options, and access to professional coaching.