" \u003cdiv class=\"ja-job-details\"\u003e \u003ch2 class=\"title\"\u003eApplication Security detection \u0026amp; Response Specialist (AVP/VP)\u003c/h2\u003e \u003cdiv class=\"meta\"\u003e \u003cul class=\"classifications\"\u003e \u003cli data-id=\"20749\"\u003e IT Security \u003c/li\u003e \u003cli data-id=\"20751\"\u003e Sydney \u003c/li\u003e \u003cli data-id=\"20752\"\u003e Permanent / Full Time \u003c/li\u003e \u003c/ul\u003e \u003cp class=\"date-posted\"\u003e 11/11/2026 \u003c/p\u003e \u003c/div\u003e \u003cul class=\"bullet-points\"\u003e \u003cli\u003eFirst Sydney hire in a global follow-the-sun application defence team\u003c/li\u003e \u003cli\u003e4-day week: 9:00am to 7:30pm, Wed to Sat OR Sun to Wed\u003c/li\u003e \u003cli\u003ePermanent | Sydney CBD | $150K to $200K + super + bonus\u003c/li\u003e \u003c/ul\u003e \u003cdiv class=\"description\"\u003e One of the world\u0026rsquo;s largest banks is building its application threat management team (Application Monitoring \u0026amp; Response) in Sydney, and this is the first seat here.\u003cbr\u003e\u003cbr\u003e It\u0026rsquo;s a front-line application security detection and response team. They watch the bank\u0026rsquo;s web applications, investigate attacks at the application layer, and write and tune the WAF signatures that stop them. You\u0026rsquo;ll report to a hiring manager in Singapore and work closely with the 7-person team there, as part of a follow-the-sun model across Australia, Singapore, the UK and the US.\u003cbr\u003e\u003cbr\u003e The role is offered at two levels depending on experience: \u003cstrong\u003eSenior Specialist\u003c/strong\u003e (AVP, 5 to 8 years) or \u003cstrong\u003eLead Specialist\u003c/strong\u003e (VP, 10+ years). You\u0026rsquo;ll have real ownership and the chance to shape how the team grows in Sydney.\u003cbr\u003e \u003cbr\u003e\u003cstrong\u003eWhat\u0027s on offer\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003e\u003cstrong\u003eSenior Specialist\u003c/strong\u003e (AVP, 5 to 8 years): $150K to $170K + super + discretionary bonus\u003c/li\u003e \u003cli\u003e\u003cstrong\u003eLead Specialist\u003c/strong\u003e (VP, 10+ years): $175K to $200K + super + discretionary bonus\u003c/li\u003e \u003cli\u003e\u003cstrong\u003e4-day week,\u003c/strong\u003e three days off. Choose Wed to Sat or Sun to Wed (9:00am to 7:30pm). In the office for the first 6 months, then one weekday from home each week\u003c/li\u003e \u003cli\u003eThe backing of a global bank, with the chance to build something new in a Sydney CBD office alongside around 40 people in the Sydney cyber team\u003c/li\u003e \u003cli\u003e\u003cstrong\u003eFirst hire \u003c/strong\u003ein this team locally, with exposure to a global defence program and threats that are very current\u003c/li\u003e \u003cli\u003eNo preference on industry background. The team likes a mix\u003c/li\u003e \u003cli\u003eA simple interview process: Technical, culture, then an in-person final.\u0026nbsp;\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eWhat you\u0027ll be doing\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eAnalyse application layer alerts, investigate attacks against the bank\u0027s web applications, and act to disrupt threat actors\u003c/li\u003e \u003cli\u003eDig into server, application, authentication and traffic logs to piece together what happened\u003c/li\u003e \u003cli\u003eWrite, maintain and fine-tune WAF signatures (F5 ASM, Akamai and similar)\u003c/li\u003e \u003cli\u003eBuild custom alerts and dashboards based on layer 7 attack and threat indicators\u003c/li\u003e \u003cli\u003eUse new threat intelligence to update existing controls and help design, test and deploy new ones\u003c/li\u003e \u003cli\u003eUse packet and network analysis tools to support investigations\u003c/li\u003e \u003cli\u003eWork with senior business leaders to triage security events and report on impact\u003c/li\u003e \u003cli\u003eMentor and develop less experienced team members\u003c/li\u003e \u003cli\u003eSupport audit, compliance and risk requirements through processes and controls\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eWhat you\u0027ll bring\u003c/strong\u003e\u003cbr\u003e \u003cstrong\u003eMust-have:\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eStrong hands-on experience in application security detection and response (this role is web and application focused, not endpoint)\u003c/li\u003e \u003cli\u003eSolid understanding of web applications (HTTP/HTTPS), common attack methods and the OWASP Top 10\u003c/li\u003e \u003cli\u003eAdvanced log analysis skills across server, application, authentication and traffic logs, using Splunk or another SIEM\u003c/li\u003e \u003cli\u003eExperience maintaining and tuning WAF signatures on leading platforms (e.g. F5 ASM, Akamai)\u003c/li\u003e \u003cli\u003eComfortable with scripting and regular expressions\u003c/li\u003e \u003cli\u003eWorking knowledge of Windows, Linux and macOS\u003c/li\u003e \u003cli\u003eClear verbal and written communication, adjusted for technical and business audiences\u003c/li\u003e \u003cli\u003eAble to work independently in a fast-paced environment and drive improvement\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eDesirable:\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eSplunk experience\u003c/li\u003e \u003cli\u003eAkamai or other CDN experience\u003c/li\u003e \u003cli\u003ePacket capture and analysis (e.g. Wireshark)\u003c/li\u003e \u003cli\u003eCertifications such as SANS/GIAC or CISSP\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eAbout Decipher Bureau\u003c/strong\u003e\u003cbr\u003e Decipher Bureau is Australia\u0027s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don\u0027t just match skills to a job description. \u003cbr\u003eWe take the time to understand both the technical requirements of a role and the team environment, so every introduction we make is a considered one.\u003cbr\u003e\u003cbr\u003e \u003cstrong\u003eInterested?\u003c/strong\u003e\u003cbr\u003e Reach out for a confidential chat:\u003cbr\u003e \u003cul\u003e \u003cli\u003eAnthony Buccat, 0452 415 858\u003c/li\u003e \u003cli\u003eabuccat@decipherbureau.com\u003c/li\u003e \u003c/ul\u003e \u003c/div\u003e \u003cdiv class=\"apply\"\u003e \u003ca class=\"back-link\" href=\"#\" title=\"Back to search results\"\u003eBack to search results\u003c/a\u003e \u003cinput type=\"button\" class=\"ja-button\" data-job-id=\"4485549\" value=\"Apply Now\" title=\"Apply Now\" /\u003e \u003c/div\u003e \u003c/div\u003e "