Cyber Incident Response Lead

Are you looking for your next state goverenmnt role?

Your new company
A leading Victorian State Government agency is seeking an experienced Cyber Incident Response Analyst to join its Information Security Services Branch, safeguarding one of the state's largest technology environments. You'll join a collaborative, forward-thinking team driving security uplift and operational resilience.

Your new role

• Lead end-to-end detection, triage, containment and recovery of cyber incidents in line with the department's Cyber Security Incident Response Plan (CSIRP).
• Conduct Level 2/3 investigations and threat hunting using Microsoft Sentinel, Splunk, Defender and EDR tools.
• Perform daily SOC monitoring, alert triage and escalation, correlating threat intelligence across platforms to identify emerging threats.
• Build and enhance Sentinel detection engineering, including analytics rules, MITRE ATT&CK mapping, workbooks, playbooks and automation, and improve SOC processes.
• Deliver situation reports, post-incident reviews, RCA reports, security metrics and executive briefings.
• Provide expert advice on Microsoft Sentinel, Defender, Google Security, Tenable and ServiceNow.
• Partner with ICT and school technical teams, service providers and Victorian Government cyber agencies to strengthen security posture.

What you'll need to succeed

• Proven experience leading cyber incident response, including CSIRT, crisis management, containment, recovery and post-incident review.
• Strong SOC background across monitoring, alert investigation, threat intelligence, threat hunting and SIEM/EDR platforms.
• Deep expertise in Microsoft Sentinel and Defender, including advanced KQL.
• Hands-on detection engineering: log management, analytics rule tuning, workbooks, playbooks, automation and use cases.
• Sound knowledge of NIST CSF, MITRE ATT&CK, ASD Essential Eight and incident response frameworks.
• Vulnerability and risk management experience, with the ability to advise technical and non-technical stakeholders.
• Excellent communication and report-writing skills (RCA reports, incident summaries, executive briefings), with confidence engaging senior executives.
• Strong analytical and problem-solving skills, with the ability to prioritise complex incidents under pressure.
• Tertiary qualifications in Cyber Security, IT or a related field, plus industry-recognised certifications.

What you'll get in return

• Lead a strategic, high-visibility government initiative.
• Hybrid working and a supportive, collaborative culture.
• Competitive daily rate with extension potential.

What you need to do now
If you're interested in this role, click 'apply now' to forward an up-to-date copy of your CV, or call us now.
If this job isn't quite right for you, but you are looking for a new position, please contact us for a confidential discussion on your career.
Hays appreciates the importance of workforce diversity and inclusion. We are an equal-opportunities employer and have policies, procedures and relationships in place to promote our understanding of all forms of diversity.#3025802