Security Operations Analyst (Tier 2)
Aristocrat is seeking an exceptionally skilled Security Operations Analyst (Tier 2) to join its Security Operations Center. The role involves protecting digital assets and maintaining flawless security standards. This position offers an outstanding opportunity to collaborate with global teams, grow within a structured mentoring program, and build a career in a modern SOC environment.
The analyst will own MSSP customer concerns and medium/high-severity alerts from start to finish, investigating endpoint, identity, network, and cloud data to reach defensible conclusions. They will also review MSSP triage for quality, provide feedback, and complete containment and remediation within approved playbooks.
- Own MSSP customer concerns and medium/high-severity alerts from start to finish.
- Scope the activity and build the timeline.
- Identify indicators of compromise (IOCs) and investigate endpoint, identity, network, and cloud data to reach a defensible conclusion.
- Review a sample of MSSP triage for quality, offering tuning, detection-gap, and escalation-criteria feedback to the MSSP.
- Triage phishing (header analysis, sandboxing), malware (static & sandbox), and credential-compromise investigations.
- Complete containment and remediation within approved playbooks - host isolation, account disablement, credential reset, IOC blocking - and record every action taken.
- Raise issues to senior specialists with a full set of information: hypothesis, evidence, actions taken, current risk, and specific ask; send well-understood benign patterns back to the MSSP along with a detailed disposition and the missing playbook step.
- Build and run queries across SIEM, EDR, and SOAR platforms and MSSP tooling to support investigations and reporting.
- Identify detection and tuning gaps.
- Flag false positives and propose tuning, suppression, or enrichment with supporting evidence.
- Test and validate detection changes shipped by the detection engineering team.
- Document every case to a high standard. Ensure it is complete, accurate, and reproducible by someone not on shift.
- Accept peer and lead QA review. Act on feedback within the same cycle.
- Support specialist-led threat hunts and incident response - evidence gathering and technical analysis from detection through root cause analysis (RCA).
- Contribute to playbook, runbook, and knowledge-base improvements drawn from your own casework.
- Participate in the 24x7 rotating shift roster, including on-call and occasional weekend coverage.
- 2+ years of hands-on SOC / security operations experience, with ownership of investigations beyond initial triage (required).
- A bachelor's degree in information systems, cybersecurity, or a related field, or equivalent experience (required).
- Query proficiency on CrowdStrike stack - CrowdStrike Query Language (CQL) - or transferable SIEM query experience (e.g., KQL, SPL) (required).
- Hands-on EDR (live response, process-tree analysis, host isolation) (required).
- Working knowledge of Windows, Linux, and Active Directory (AD) / Entra ID attack patterns; comfortable reading authentication, process, and network logs without a playbook (required).
- A solid grasp of the incident-response process, phishing and malware investigations; MITRE ATT&CK for mapping observed behavior (required).
- Security+, ISC2 SSCP, Microsoft SC-200, CrowdStrike (CCFA/CCFR), Blue Team Level 1/2 (BTL1/BTL2), GCIA, GCIH, or CySA+ certifications (nice-to-have).
- Cloud security monitoring (AWS, Azure, or GCP) (nice-to-have).
- Scripting (Python or PowerShell) (nice-to-have).
- SOAR/automation (nice-to-have).
- Exposure to detection tuning or threat hunting (nice-to-have).
- Comprehensive pay and benefits package designed to stay competitive in the market, support wellbeing, and recognise contribution.
- Annual bonuses and incentives.
- Health and wellbeing benefits.
- Paid time off.
- Retirement plans.
- Insurance coverage.
- Other local or statutory benefits.
Aristocrat Leisure Limited is an Australian gaming and technology company and one of the world's largest providers of gambling products. Listed on the Australian Securities Exchange and headquartered in Sydney, it designs and manufactures electronic gaming machines and casino-management systems, and runs sizeable online real-money gaming (Aristocrat Interactive) and mobile games (Pixel United) businesses. Founded in 1953, the group employs more than 7,000 people across over 20 locations worldwide. It is the largest gaming-machine manufacturer in Australia and among the biggest slot-machine makers globally.