Senior Cyber Threat Analyst

The position title in BuyICT doesn't exist, please note this role is an APS6 SIEM, SOAR, and Cyber Threat Intelligence Engineer  The Commission is maturing its cyber infrastructure and advancing its Identity and Access Management (IAM) capability as a critical component of its Cyber Uplift Program. We are seeking an experienced SIEM, SOAR, and Cyber Threat Intelligence Engineer who will play a pivotal role in the design, implementation, and management of innovative cybersecurity solutions. This role is central to our mission to enhance security postures, improve incident response, and align with government regulatory standards and best practices. The successful candidate will support the design and operationalisation of a robust security event management capability while contributing to the overall cybersecurity strategy at the Commission.  Key duties and responsibilities Strategic Security Event Management Architecture and Design:  Architect and Develop: Support the creation of a scalable and resilient security event management system, including SIEM and SOAR platforms, that aligns with Commission’s strategic goals, security policies, and regulatory requirements such as the Essential 8 and ISO27001:2022.  Innovation and Vision: Identify and leverage emerging cybersecurity trends, including advancements in SIEM, SOAR, and threat intelligence technologies, to future-proof the Commission’s security landscape.  Tactical Alignment: Support the integration of security event management strategies into broader cybersecurity initiatives, enabling a comprehensive and cohesive security architecture that enhances threat detection and incident response capabilities.  Implementation and System Integration:  Deployment Leadership: Direct the deployment of the Commission’s SIEM solution, leveraging the existing Splunk instance and ensuring that all integrations with SOAR and threat intelligence platforms are seamless, secure, and scalable.  Collaboration: Work closely with IT, cybersecurity teams, and external vendors to ensure the SIEM, SOAR, and threat intelligence solutions are fully integrated with other security and operational systems, enhancing overall system effectiveness and security.  Security and Compliance Management:  Policy Development and Enforcement: Support the development of, and enforce, event management policies, ensuring alignment with regulatory requirements including the Information Security Manual (ISM).  Risk Management: Conduct regular security assessments, audits, and reviews to identify and mitigate potential risks related to SIEM, SOAR, and threat intelligence operations.  Incident Management: Contribute to the response to security incidents related to SIEM and SOAR, ensuring swift and effective resolution while minimising the impact onthe Commission’s critical operations.  Security Event Lifecycle Management:  SIEM Oversight: Support the management of the entire lifecycle of security events, from detection through resolution, ensuring that event management processes are accurate, compliant, and effectively mitigate risks.  Privileged Access Management: Implement and oversee Privileged Access Management (PAM) practices to safeguard critical systems and data, ensuring that all privileged access is controlled and monitored.  Collaboration and Support:  Cross-Functional Collaboration: Partner with cross-functional teams, including IT, HR, Compliance, and external vendors, to ensure that security event management systems meet the needs of all stakeholders.  Technical Guidance and Mentorship: Provide specialist technical guidance and mentorship to the Commission’s  staff, fostering a culture of continuous learning, development, and cybersecurity awareness.  Stakeholder Engagement: Engage with senior leadership and external partners to communicate strategies, progress, and challenges related to SIEM, SOAR, and threat intelligence initiatives effectively.  Continuous Improvement and Innovation:  Process Optimisation: Continuously evaluate and refine security event management processes, seeking opportunities to enhance efficiency, effectiveness, and user experience.  Training and Awareness: Design and deliver training programs to raise awareness of SIEM, SOAR, and threat intelligence best practices among the Commission staff, ensuring widespread understanding and adherence.  Metrics and Reporting: Develop and manage metrics related to SIEM, SOAR, and threat intelligence, providing regular reports to senior leadership on the performance and impact of these initiatives.  Criteria The buyer has specified that each candidate must provide a one page pitch to address all criteria specified. This is equal to 5000 characters. Essential criteria Weighting 1. Capability to provide the service. Weighting: 60% 2. Demonstrated knowledge and experience. Weighting: 40% Opportunity summary Sellers can submit Up to 1 candidate Number of sellers invited Fewer than 5 Number of candidates submitted Fewer than 10 Send us feedback About Accessibility Privacy Terms of use Disclaimer and copyright An initiative of the Digital Transformation Agency The Australian Government acknowledges the Traditional Owners of Country throughout Australia and acknowledges their continuing connection to land, waters and community. We pay our respects to the people, the cultures and the Elders past and present. © Commonwealth of Australia