Senior SOC Analyst
Summary
Senior (Level 2) SOC analyst and technical lead in a Melbourne-based managed Security Operations Centre, owning complex investigations and incident response, mentoring Level 1 analysts, and building detection use cases and SOAR automation. Core platforms are Microsoft Sentinel/Defender XDR and CrowdStrike Falcon, with hunting in KQL and CQL.
Salary: $115,000 – $150,000 per year
About the role
We are looking for a highly technical Senior SOC Analyst who is ready to lead. You will be the senior Level 2 analyst and escalation point within our SOC, owning complex investigations and incident response while raising the bar for how our SOC detects, responds to, and reports on threats. Our SOC operates as a global team. Based in Melbourne, you will be our technical lead and standard-bearer for SOC quality, working closely with our global SOC analysts and platform engineers. You will set and uphold operating standards, coach analysts, drive the development of detection use cases and SOAR automation, and ensure every client receives consistent, proactive, high-quality service. Microsoft Sentinel and CrowdStrike Falcon are our two core platforms, and you will bring deep, hands-on expertise in at least one of them and a solid working knowledge of the other.
Key responsibilities
Serve as the Level 2 escalation point for alerts and incidents raised by Level 1 analysts, and own complex or high-severity cases through to resolution.
Perform in-depth investigations across endpoint, identity, email, network, and cloud telemetry to determine scope, root cause, and impact.
Correlate events across Microsoft Sentinel, Microsoft Defender XDR and the CrowdStrike Falcon platform to build an accurate picture of attacker activity.
Validate, classify and prioritise incidents, and make sound, timely escalation decisions.
Lead and coordinate the technical response to security incidents across the full lifecycle: preparation, detection, containment, eradication, recovery and lessons learned.
Execute containment actions such as host isolation, account disablement, session revocation and indicator blocking, in line with agreed client runbooks.
Collect and analyse forensic artefacts (endpoint, memory, logs) to support investigations and evidence preservation.
Produce clear incident reports and post-incident reviews for both technical teams and executive stakeholders, including recommendations to prevent recurrence.
Plan and run proactive, hypothesis-driven threat hunts using KQL in Sentinel and Defender XDR, and CrowdStrike Query Language (CQL) in Falcon Next-Gen SIEM and Event Search.
Design, build, test and fine-tune detection use cases, including Sentinel analytics rules, Defender XDR custom detections, CrowdStrike custom IOAs and Next-Gen SIEM correlation rules.
Develop and maintain Sentinel automation rules and playbooks (Azure Logic Apps) and CrowdStrike Falcon Fusion SOAR workflows.
About you
At least 5 years of cybersecurity experience, including at least 3 years in a SOC and at least 2 years operating at Level 2 or above.
Ability to communicate clearly and calmly with clients during incidents, and present findings to both technical and non-technical audiences
Deep, hands-on expertise in Microsoft Sentinel or CrowdStrike Falcon, with working knowledge of the other.
Advanced query skills in KQL or CrowdStrike Query Language (CQL), with the ability to quickly become proficient in both.
Proven experience leading incident response for real-world incidents such as ransomware, business email compromise, credential compromise and malware outbreaks.
Demonstrated threat hunting experience and a strong working knowledge of the MITRE ATT&CK framework.
Track record of developing and fine-tuning detection use cases and reducing false positives in a production environment.
Solid understanding of Windows, Linux and macOS internals, Active Directory, networking fundamentals and common attack techniques.
Experience investigating security events in cloud environments, particularly Microsoft 365 and Azure, with AWS exposure an advantage.
Experience guiding, mentoring or leading other analysts, whether formally or informally.
At least one current certification in our core platforms: Microsoft Certified: Security Operations Analyst Associate (SC-200), or a CrowdStrike Falcon certification such as CrowdStrike Certified Falcon Responder (CCFR), Falcon Hunter (CCFH), SIEM Analyst (CCSA) or SIEM Engineer (CCSE).
About us
BluBiz Solutions is an Australian-owned, award-winning ICT solutions and managed services provider based in Melbourne. Since 2017, we have delivered expertise across Enterprise Networking, Cybersecurity, Cloud and Infrastructure, Collaboration, Mobility and IT Service Support to clients in the not-for-profit, health, aged care, education, retail and construction sectors, many of whom have partnered with us for several years. We are a three-time CRN Fast 50 company, ISO 27001 certified end-to-end, a top-50 Australian Telstra partner, a Microsoft Modern Work Solution Designation partner and a 2025 Cisco Partner Winners Circle recipient. Cybersecurity is at the heart of what we do. Our managed Security Operations Centre (SOC) protects our clients around the clock, and we are investing to make it one of the most capable and trusted SOC services in the Australian mid-market.
Benefits
A senior, high-impact role with real influence over how we shape and deliver our SOC services.
Exposure to a client portfolio and modern security platforms.
Ongoing investment in your learning, development and certifications.
Flexible hybrid working and a supportive, collaborative team culture.
A competitive salary package aligned to your experience.
A defined career pathway as our cybersecurity practice grows, with clear progression to Level 3 Analyst and SOC Manager, or into specialist areas such as detection engineering, threat intelligence, incident response and security architecture.