Lead Detection and Response Engineer

About Skillfield

Skillfield is a specialist technology consultancy operating at the intersection of cyber, data and AI. We partner with enterprise clients to protect, transform and enable their organisations through thoughtful, outcome-focused solutions. Our reputation is built on impact, not effort.

About the Role

Location: Melbourne, hybrid

Contract: Full-time, permanent or contract

We're looking for a Lead Detection and Response Engineer who loves building. You'll engineer the detections, automations and artificial intelligence (AI) agents that let security operations centres (SOCs) find and stop threats faster, with analysts focused on the work that needs a human.

You'll be hands-on across security information and event management (SIEM), security orchestration, automation and response (SOAR) and extended detection and response (XDR) platforms for our clients, and you'll guide and develop a small team of engineers as you do it. You'll build AI agents that triage, enrich and investigate alerts, connect them to the tools analysts already use, and measure whether they're actually getting it right.

What you'll do

- Build, tune and maintain detection content mapped to MITRE ATT&CK, using Kusto Query Language (KQL), Search Processing Language (SPL) or similar

- Onboard and normalise log sources into SIEM platforms such as Microsoft Sentinel, Splunk or Google Security Operations, and keep data pipelines healthy and cost-effective

- Build automation playbooks in SOAR platforms such as Azure Logic Apps, Cortex XSOAR or Splunk SOAR, from enrichment through to containment

- Build AI agents that triage, enrich and investigate alerts, for example on Azure AI Foundry with Azure OpenAI, and integrate them with SIEM, SOAR, ticketing and chat tools through application programming interfaces (APIs) and the Model Context Protocol (MCP)

- Integrate and extend vendor AI agents such as Microsoft Security Copilot, including custom plugins and agents

- Put guardrails around AI agents: scoped identities and permissions, human approval for high-impact actions, protection against prompt injection, and logging of every action

- Measure detection and agent quality, including false positive rates, agent accuracy against analyst decisions and time to respond, and use the results to improve both

- Mentor and support a small team of engineers, review their detections and code, and set engineering standards

- Support incident response and threat hunting when clients need deeper investigation

- Collaborate with our architects to turn designs into working solutions, and feed real-world lessons back into Skillfield's offerings

About you

- Strong hands-on experience in detection engineering, SOC engineering or incident response, including time as a technical lead

- Deep experience with at least one major SIEM, ideally Microsoft Sentinel, and with SOAR automation such as Azure Logic Apps

- Hands-on experience building AI agents or large language model (LLM) automation, or integrating agents such as Microsoft Security Copilot into SOC workflows, and an understanding of where they fail

- Strong scripting skills in Python and query languages such as KQL or SPL, and comfort working with APIs

- Full Australian working rights

Great if you also have

- Experience with Microsoft Defender XDR or another XDR or endpoint detection and response (EDR) platform such as CrowdStrike Falcon

- Experience with infrastructure as code or detection as code, such as Terraform, Bicep or Git-based content pipelines

- Familiarity with MITRE ATT&CK and common attack techniques

- Consulting or managed security services experience is highly regarded

Why Skillfield?

- Be part of a team serious about doing work that matters

- Join a culture that values clarity, autonomy and shared success

- Enjoy flexibility, strong support and performance-based recognition

Ready to make a measurable impact?

Apply now and help us deliver impact that matters.

Skillfield is committed to an inclusive workplace. If you need any adjustments during the recruitment process, let us know and we'll work with you.