You might be ready for more responsibility, but there isn’t an opportunity to take it on where you work. Or perhaps you’re already an L3 who enjoys the technical work and wants more flexibility and freedom in how you do it.
We’re recruiting three L3 SOC Analysts into an established managed detection and response team. You can work fully remotely from anywhere in Australia, so moving into the role doesn’t need to mean moving cities or adding a commute.
Theyre open to strong L2s who are ready to step up. Four of the six current L3s were promoted internally, so they’ve backed people making that move before. You don’t need to be the finished article, but you do need to have taken ownership of investigations and be ready for the responsibility that comes next.
You’ll be the person other analysts turn to when an investigation gets difficult. You’ll work out what’s happened, how far it’s gone and what needs to be done to contain it. The environment is heavily Microsoft-focused, so you’ll need to be comfortable working in Defender, writing KQL and investigating across endpoints, identity and email.
What stood out from the briefing was the freedom outside incident response. If there’s something you’ve wanted to spend more time developing, whether that’s hunting, automation, training other analysts or building a new technical capability, the manager is open to giving you room to pursue it.
Much of the team has worked together for years. The approach is to trust people to get on with their work, support their ideas and give them the chance to develop.
There is an out-of-hours on-call rotation of around one week in six. You’ll receive an allowance and additional callout payments, with provision for time off if you’ve been responding to an incident overnight.
When that call comes, you need to be comfortable taking the technical lead. A service delivery lead handles major-incident coordination and client communications, allowing you to focus on the investigation and response.
Your current title matters less than what you’ve personally done. We’ll want to hear about incidents you’ve investigated, the decisions you made, what you contained yourself and where you needed help. Services experience is useful, but it isn’t essential.
Australian citizenship and eligibility for NV1 clearance are required. You don’t need to hold clearance already, as they can sponsor it.
If you want to chat more, give me a shout russell@theonset.com.au / 0438984265