Senior SOC Analyst
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Nice to have
- Hands-on experience with Microsoft Sentinel, including incident investigation and Kusto Query Language.
- Hands-on experience with CrowdStrike Falcon for endpoint detection, investigation and response.
- Experience with SOAR, case management or ServiceNow SecOps.
- Experience tuning detections, improving investigation playbooks or identifying telemetry and coverage gaps.
- Familiarity with MITRE ATT&CK or a comparable framework for describing adversary behaviours and investigative findings.
- Relevant Microsoft, CrowdStrike or comparable industry certifications are desirable.
Full description
About the Role
We are seeking an experienced Senior Security Operations Centre (SOC) Analyst, based in Canberra / Auckland / Wellington, to provide advanced monitoring, investigation, triage and incident coordination across managed customer environments. This is a hands-on senior operational role within a rotating 24/7 roster, including scheduled day, evening, overnight, weekend and public holiday coverage.
Australian or New Zealand citizenship is mandatory. Current or reinstatable AGSVA NV1 Security clearance or equivalent clearance level in NZ is required.
Role Purpose
The Senior SOC Analyst acts as the technical escalation point during assigned shifts, validates complex or high-severity cases, supports timely and evidence-based decisions, and maintains clear ownership through escalation, response and handover. The role provides day-to-day technical leadership without formal line-management responsibility and supports developing analysts through mentoring, peer review and practical guidance.
Advanced Threat Monitoring and Detection
- Perform advanced analysis and investigation of security alerts, incidents and anomalous activity across customer environments.
- Act as a senior technical escalation point for complex, high-severity or time-critical events, validating findings, incident classifications, escalation decisions and recommended customer actions.
- Correlate evidence across endpoint, identity, cloud, network, authentication and application data sources to determine scope, impact and likely attacker behaviour.
Incident Coordination
- Coordinate initial incident scoping and support response activity within approved customer procedures, authority and escalation paths.
- Review complex escalations and provide constructive peer review of investigations, tickets, reports and recommended response actions.
- Contribute to incident reviews and lessons learned, translating operational findings into improvements to processes, playbooks and detection outcomes.
Shift Leadership and Quality Assurance
- Provide technical oversight and mentoring during assigned shifts, helping analysts make sound decisions while retaining appropriate case ownership.
- Maintain and assure clear, accurate and complete investigation records, customer updates, shift logs and handover notes.
- Lead structured shift handovers and ensure every active incident has a documented status, owner, risk position and next action.
Customer Engagement and Service Excellence
- Participate in customer discussions where senior analytical input or a clear explanation of an incident, evidence and recommended next steps is required.