Senior Security Operations Analyst

Act as the final technical escalation point for complex, ambiguous or high-severity incidents raised by Level 1 and Level 2 analysts.

Lead deep technical analysis across endpoint, identity, network and cloud evidence sources during major incidents.

Provide technical leadership across incident workstreams and support incident commanders with findings, timelines and containment options.

Conduct post-incident reviews, identify detection and response gaps, and translate findings into improved detection content.

Participate in escalation and on-call arrangements were required to support extended-hours coverage.

Translate threat intelligence into prioritised detection requirements aligned with the firm’s threat profile.

Conduct structured, hypothesis-driven threat hunts across SIEM, endpoint, identity and cloud telemetry.

Convert threat-hunting findings into repeatable detection logic, automation and documented hunting queries.

Monitor adversary tradecraft, vulnerabilities and emerging threats, assessing their relevance and detection implications.

Mentor and coach Level 1 and Level 2 analysts in investigation techniques, query development and detection engineering concepts.

Peer review detection content created by other analysts and engineers, ensuring agreed quality standards are maintained.

Improve SOC playbooks, triage guidance and response workflows associated with detection content.

Work closely with internal technology teams and security specialists to deliver effective security outcomes.

Support client and stakeholder engagements where the SOC provides managed or advisory security services.

You are an analytical problem-solver who can navigate ambiguity, connect complex technical evidence and make sound decisions during high-pressure security incidents.

You are a collaborative technical leader who builds trusted relationships, shares knowledge and supports others to strengthen their investigation and detection capabilities.

You are a clear and influential communicator who can translate complex technical findings into concise guidance for analysts, incident leaders, stakeholders and clients.

To be successful in this role, you will bring:

Demonstrated experience developing and maintaining detection content within SIEM or XDR platforms, including rule authoring, testing and tuning.

Advanced capability in query languages such as KQL, SPL or equivalent, with experience writing and optimising complex queries.

Practical knowledge of MITRE ATT&CK and experience assessing and improving detection coverage against prioritised threats.

Senior-level experience in a Security Operations Centre or an equivalent operational cyber security environment.

Proven experience leading the analysis of complex security incidents across endpoint, identity, network and cloud environments.

Strong knowledge of enterprise and cloud log sources, telemetry, data quality and normalisation.

A sound understanding of cyber security frameworks, standards and industry-leading practices.

Strong written and verbal communication skills, including the ability to clearly document detection logic, investigation guidance and response actions.

The following experience will be highly regarded:

Experience applying detection-as-code practices, including source control and CI/CD pipelines for security content.

Scripting and automation capability using Python, PowerShell or SOAR playbook development.

Experience conducting adversary emulation or purple team testing to validate detection coverage.

Experience within professional services, consulting or a managed security services environment.

A tertiary qualification in Cyber Security, Computer Science, Information Technology or another relevant technical discipline.

Relevant industry certifications, such as SC-200, SC-300, AZ-500, CISSP, CompTIA Security+, ISC2 certifications or GIAC certifications including GCDA, GCIA, GCFA or GCTI.

Advanced training in detection engineering, threat hunting or SIEM technologies, supported by an ongoing commitment to professional development.

KPMG is a professional services firm with global outreach and deep sector experience. We work with clients across an array of industries to solve complex challenges, steer change and enable growth.

Our people are what make KPMG the thriving workplace that it is and what sets us apart is that we know great minds think differently. Collaborate with a team of passionate, highly skilled professionals who’ve got your back. You’ll build relationships with unique and diverse colleagues who will provide you with the support you need to be your best and produce meaningful and impactful work in an inclusive, equitable culture.

At KPMG, you’ll take control over how you work. We’re embracing a new way of working in many ways, from offering flexible hours and locations to generous paid parental leave and career breaks. Our people enjoy a variety of exciting perks, including retail discounts, health and wellbeing initiatives, learning and growth opportunities, salary packaging options and more.

Diverse candidates have diverse needs. During your recruitment journey, information will be provided about adjustment requests. If you require additional support before submitting your application, please contact the Talent Attraction Support Team .

KPMG Australia: grow with us!