Cyber Security Analyst
Cyber Security Analyst on Amwins' newly formed Australasia Division in Sydney, acting as first line of defense: monitoring, triaging, and responding to security events with Microsoft Defender XDR and Sentinel, hunting threats with KQL, applying AI-assisted triage, and supporting incident response in a follow-the-sun team.
- Compensation
- Not disclosed
- Location
- Sydney, New South Wales, Australia
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Full time
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- 2–3 years minimum experience in security operations, incident response, or related IT role
- Hands-on experience with Microsoft Defender XDR (Endpoint, Identity, Cloud Apps) and Microsoft Sentinel
- Working proficiency in KQL and advanced hunting
- Understanding of the incident response lifecycle
- Understanding of MITRE ATT&CK
- Understanding of SIEM and XDR concepts
- Understanding of Windows and Active Directory/Entra ID
- Networking fundamentals
- Understanding of cloud security
- Working knowledge of applying generative AI and AI-assisted tools to security operations (alert triage, query development, incident summarization, enrichment) with judgment to validate outputs
- Natural curiosity and passion for cybersecurity with self-driven learning, such as maintaining a home lab and participating in CTF events
- Clear written and verbal communication, including disciplined case documentation, shift handoff, and effective escalation
- Comfort collaborating across time zones in a follow-the-sun team
Nice to have
- Scripting or automation experience (PowerShell, Python)
Full description
Cyber Security Analyst
The Cybersecurity Analyst is a member of the Cybersecurity department, supporting the newly formed Amwins Australasia Division. The analyst serves as the first line of defense in security event monitoring, working to detect and mitigate threats to the organization. Using Microsoft Defender XDR and other security tools, the analyst monitors for security events, responds to security related service requests from users, and conducts in depth analysis of logs and security alerts to identify potential threats.
The Analyst works closely with internal teams to ensure effective containment and eradication, helps build repeatable security processes within the Security team, and assists with projects and tasks as directed. Most importantly, they build relationships to increase the security mindset of the organization through collaboration.
This role is built for someone with a natural curiosity and a genuine passion for cybersecurity: a person who keeps learning as threats, tools, and techniques evolve, including how AI can make detection and response faster and more effective.
Responsibilities
- Monitor, triage, and respond to security events and alerts using Microsoft Defender XDR and related security tools, serving as the first line of defense against security threats.
- Conduct in-depth analysis of logs, network traffic, and security alerts to identify potential threats, using Kusto Query Language (KQL) for investigation and proactive threat hunting.
- Apply AI-assisted capabilities to accelerate alert triage, investigation, enrichment, and response, validating AI-generated output.
- Facilitate security event response and containment during a Security Incident and coordinate response and recovery efforts with other members of the team and internal partners to ensure effective containment and eradication.
- Respond to and resolve security related service requests from users.
- Escalate identified risk to the Technology Risk and Compliance program as well as Senior Management.
- Make recommendations to enhance the effectiveness of controls.
- Create and update process documentation as needed and assist with the creation of security processes to establish repeatable practices within the Security team.
- Create reporting, as directed, to ensure effective security operations.
- Stay current on emerging threats, adversary techniques, and security tooling, and share what is learned with the team to continuously improve detection and response.
- Maintain well documented cases for case/shift handoff to support a follow-the-sun operating model.