Lead Data Engineer

Data Engineers prepare raw data for analytical or operational uses. They make data accessible so that it can be used for optimisation, delivery of services and enhanced analytics solutions. Cyber Security Automation Engineer is responsible for designing, developing, integrating and continuously improving automation and detection capabilities across the organisation’s Cyber Security Operations Centre (CSOC) and broader cyber security functions. The role provides specialist engineering capability across Cyber Threat Detection, Security Operations, Threat Intelligence, Threat Hunting and Incident Response, with a strong focus on Integrating these functions through automation, orchestration, data enrichment and repeatable engineering practices. The Cyber Security Automation Engineer will work closely with security analysts, detection engineers, threat intelligence specialists, threat hunters, incident responders, security architects and platform engineering teams to identify opportunities where automation can improve the speed, consistency, accuracy and effectiveness of cyber security operations. The role will also contribute to the engineering and optimisation of detection capabilities, ensuring that security telemetry, threat intelligence and analytical techniques are translated into actionable detections and automated response workflows. Key duties and responsibilities Identify high-value opportunities for automation across detection, monitoring, investigation, threat hunting and incident response process. Develop automated workflows and playbooks to reduce repetitive analyst activities and improve response times. Automate alert enticement, triage, investigation, escalation, containment and remediation process where appropriate. Develop reusable automation components, functions, integrations and security services. Integrate security platforms through APIs or other suitable integration mechanisms. Develop scripts and applications using languages such as Ansible, Python, PowerShell and other appropriate technologies. Implement appropriate validation, exception handling, logging, monitoring and security control with automated workflows. Maintain automation code using source control, power review, testing and controlled deployment practices. Automate ingestion, normalisation, enrichment and distribution of threat intelligence. Integrate external and internal threat intelligence sources with Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Transaction Internet Protocol (TIP), Endpoint Detection and Response (EDR), Network Detection and Response (NDR), and other security platforms. Automate Indicator of Compromise (IOC) lifecycle management including validation, enrichment, scoring, expiry and removal. Develop mechanisms to measure whether threat intelligence is contributing to meaningful detection and response outcomes. Apply software Engineering and DevSecOps practices including Continuous Integration and Continuous Delivery (CI/CD) pipeline, source control, automated testing, controlled releases etc. Determine data requirements to support use cases and playbooks in support of event logging strategy. General requirements Share knowledge and expertise as the subject matter expert and provide assistance and mentorship to colleagues. Work collaboratively as part of a cross-functional agile team to achieve defined project outcomes. Act with integrity by promoting workplace practices aligned with the APS Values and the APS Code of Conduct. Exercise delegation in accordance with legislation and guidelines. Knowledge / Qualifications Cyber security knowledge and experience Protective Security Policy Framework (PSPF) Information Security Manual (ISM) Essential 8 Strategies National Institute of Standards and Technology (NIST) Incident response lifecycle (such as Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned (PICERL) 5+ years of hands-on experience designing and building cyber security automation playbooks, workflows in an enterprise or government environment. Experience integrating SIEM/SOAR platforms with enterprise security and IT systems via APIs, webhooks and custom connectors. Strong scripting skill in Ansible, Python, PowerShell etc security automation and tool integration. Understanding of security operations process including incident triage, threat hunting, vulnerability management and incident response. Ability to translate security requirements into automated technical solutions and communicate outcomes to technical and non-technical stakeholders. Technical Skills (continued) • Representational State Transfer (REST) Application Programming Interface (APIs). • JavaScript Object Notation (JSON). • and related integration technologies. • CI/CD and DevSecOps. Criteria The buyer has specified that each candidate must provide a one page pitch to address all criteria specified. This is equal to 5000 characters. Essential criteria 1. Demonstrated substantial hands-on experience designing, developing, implementing and continuously improving cyber security automation and orchestration capabilities within a large and complex enterprise or government environment. The response should include examples of automated security workflows or playbooks supporting detection, alert triage, investigation, threat hunting, containment, remediation or incident response. 2. Demonstrated experience integrating SIEM, SOAR and other enterprise security or ICT platforms using REST APIs, webhooks, custom connectors and structured data formats. This must include strong practical development experience using Ansible, Python, PowerShell or comparable automation technologies, supported by examples of solutions implemented by the candidate. 3. Demonstrated understanding and practical application of cyber security operations, engineering and risk management principles, including threat detection, security monitoring, threat intelligence, vulnerability management, incident response and relevant Australian Government security frameworks such as the PSPF, ISM and Essential Eight. 4. Demonstrated ability to translate operational and cyber security requirements into secure, reliable and maintainable automated solutions. This must include experience applying software engineering and DevSecOps practices such as source control, peer review, automated testing, continuous integration and delivery, controlled releases, exception handling, audit logging, monitoring and technical documentation. Desirable criteria 1. Demonstrated experience engineering integrations across a broad enterprise security ecosystem, including technologies such as threat intelligence platforms, endpoint or network detection and response, identity and access management, vulnerability management, cloud security, firewalls, case management, ticketing, asset management and configuration management databases. 2. Demonstrated experience automating the ingestion, normalisation, enrichment, scoring, distribution and lifecycle management of threat intelligence, including experience with technologies or standards such as STIX and TAXII. 3. Demonstrated knowledge or experience in emerging security engineering approaches, including artificial intelligence-enabled security operations, detection-as-code, automation frameworks and threat detection technologies or formats such as Snort, Suricata, YAML, Zeek and JSON. 4. Demonstrated ability to work effectively within multidisciplinary and cross-functional delivery teams, communicate complex cyber security and automation concepts to technical and non-technical stakeholders, and contribute to organisational capability through mentoring, collaboration, documentation and knowledge transfer. Opportunity summary Sellers can submit Up to 2 candidates Number of sellers invited More than 10 Number of candidates submitted Fewer than 10 RFQ closing time 02 Weeks 01 Days 06 Hours Send us feedback About Accessibility Privacy Terms of use Disclaimer and copyright An initiative of the Digital Transformation Agency The Australian Government acknowledges the Traditional Owners of Country throughout Australia and acknowledges their continuing connection to land, waters and community. We pay our respects to the people, the cultures and the Elders past and present. © Commonwealth of Australia