Sr Engineer II - SecOps Insider Threat
Aristocrat is seeking a Sr Engineer II for its SecOps Insider Threat team. This role is based within the Security Operations Center and focuses on ensuring the safety and integrity of organisational systems. The position involves leading complex security investigations, defining detection strategies, and driving impactful security initiatives to protect company assets.
The successful candidate will act as an incident lead for high-severity security events and provide mentorship to junior analysts. The role requires a collaborative approach, working across global teams to enhance security operations maturity and maintain high standards of incident response.
- Serve as the incident lead for handling and investigating high-severity and complex security incidents from beginning to end.
- Focus on defining the incident scope, containment, eradication, and recovery phases.
- Work closely with technical and business partners.
- Assume responsibility for the root-cause analysis.
- Lead complex, multi-stage investigations across endpoint, identity, network, cloud, and SaaS telemetry, including advanced malware analysis, credential-compromise, and lateral-movement investigations.
- Define detection strategy aligned to MITRE ATT&CK and the organisation’s threat model; identify and recommend new detection logic across SIEM, XDR, EDR, and SOAR.
- Conduct threat hunts guided by threat intelligence, emerging TTPs, and gaps in detection coverage; convert findings into new detections, playbooks, and control recommendations.
- Lead Tier 2 SOC operations, ensuring shift priorities, case load, and blocking issue flow meet SLAs and quality standards.
- Build and maintain SOC playbook, runbook, and knowledge-based library; ensure content stays current with tooling and threat changes.
- Identify, build, and recommend process improvements across the SOC, measuring and reporting their impact.
- Chip in to and help implement the multi-year security operations strategy, including detection coverage roadmap, telemetry strategy, automation targets, and capability maturity.
- Interpret security findings as risk-centered advice for security engineering, IT, and business collaborators.
- Mentor and develop Tier 1 and Tier 2 analysts through structured mentoring, investigation walkthroughs, and technical training.
- Participate in cross-functional forums and collaborate with global security teams to ensure a cohesive, consistent approach to security operations.
- Provide senior on-call coverage for major incidents involving blocking issues.
- 8+ years in security operations, incident response, detection engineering, or an equivalent blue-team role (required).
- Bachelor’s degree in Information Systems, Cybersecurity, or a related field, or equivalent experience (required).
- Advanced certifications such as GCIA, GCIH, GCFA, GCDA, GNFA, GREM, OSCP, Microsoft SC-200 or equivalent (preferred).
- Expert knowledge of Windows, Linux, Active Directory, and Entra ID charge techniques (required).
- Strong experience in cloud security monitoring and response across at least one major provider (AWS, Azure, or GCP) (required).
- Proficiency in Python or PowerShell for automation, data analysis, and tooling integration (required).
- Deep solid understanding of MITRE ATT&CK, the incident response lifecycle, malware analysis, and phishing investigation (required).
- Track record of defining standards, processes, and playbooks, and of improving them based on evidence (required).
- Demonstrated ability to mentor analysts and raise the technical bar of a team (required).
- Clear, structured technical writing, including incident reports, RCAs, and briefings for senior technical and non-technical audiences (required).
- Strong influencing and teamwork skills (required).
- Offer a comprehensive pay and benefits package designed to stay competitive in the market, support your wellbeing, and recognise your contribution to our success.
- Your specific compensation package will be determined by factors such as your skills, experience, qualifications, and location.
- Depending on your role and location, you may be eligible for annual bonuses and incentives, health and wellbeing benefits, paid time off, retirement plans, insurance coverage, and other local or statutory benefits.
Aristocrat Leisure Limited is an Australian gaming and technology company and one of the world's largest providers of gambling products. Listed on the Australian Securities Exchange and headquartered in Sydney, it designs and manufactures electronic gaming machines and casino-management systems, and runs sizeable online real-money gaming (Aristocrat Interactive) and mobile games (Pixel United) businesses. Founded in 1953, the group employs more than 7,000 people across over 20 locations worldwide. It is the largest gaming-machine manufacturer in Australia and among the biggest slot-machine makers globally.
