Threat Intelligence & Threat Hunting Lead

Salary: $180,000 + Super

A major Australian energy and critical infrastructure organisation is building a brand-new Threat Intelligence and Threat Hunting capability inside its Cyber Defence team, and they need a hands-on technical lead to own it.

This is an individual contributor role. You’ll be the technical lead and escalation point for hunting and intel, working closely with Cyber Defence, Offensive Security, Network Security and OT Security. For the first six months, the focus is roughly 70% hunting and 30% intelligence.

If you can explain what “evil” looks like in endpoint and network telemetry, and
you’d enjoy building a hunting program from scratch in an environment that genuinely matters, read on.

What’s on offer

• The chance to design and own a new capability rather than inherit someone else’s
• Real scope: IT, OT and cloud environments in critical infrastructure
• Room to grow your detection engineering and scripting skills, with support from the wider cyber team
• Exposure to senior stakeholders through threat actor briefings
• A genuinely collaborative team, and they’re tool agnostic

What you’ll be doing

• Lead the build and continuous improvement of the threat hunting and threat intelligence capability
• Plan and run hypothesis-driven threat hunts: threat-led investigations into specific actors and TTPs, broad IoC sweeps, and theory-based hunts (for example DNS exfiltration)
• Turn successful hunts into automated detections, playbooks and use cases mapped to MITRE ATT&CK
• Centralise and curate threat intelligence sources and feed them into security monitoring and incident response
• Support incident response with threat actor context and technical analysis
• Produce threat intel reporting and occasional briefings for technical teams and senior stakeholders
• Build relationships with external intel providers, industry peers and government agencies

What you’ll bring
Must-have:

• 4+ years in threat hunting, cyber threat intelligence, DFIR or a closely related discipline
• Hands-on hunting experience using endpoint, network, cloud and identity telemetry
• Strong understanding of forensic artefacts and adversary TTPs, and the ability to walk through a hunt methodology end to end
• Experience with SIEM, EDR/XDR and threat intelligence platforms for investigation and hunting
• Working knowledge of MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model
• Clear communication with both technical and non-technical audiences

Desirable:

• DFIR background strongly preferred
• Detection engineering and scripting experience (willingness to learn is fine)
• OT, energy, utilities or telco experience
• Experience tracking APT activity and building threat actor dossiers
• Malware analysis skills
• Certifications such as GCFA, GCTI, GCIH, GNFA or CTIA

Essential requirement
Australian citizens, permanent residents and New Zealand citizens only. Unfortunately, we can’t consider visa holders for this role.

About Decipher Bureau
Decipher Bureau is Australia’s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don’t just match skills to a job description. We take the time to understand the technical demands of a role and whether a candidate will genuinely thrive in the team. Because the right placement beats a quick one, every time.

Interested?
Reach out for a confidential chat:

• Anthony Buccat: 0452 415 858
• abuccat@decipherbureau.com