" \u003cdiv class=\"ja-job-details\"\u003e \u003ch2 class=\"title\"\u003eSenior Cloud Security Analyst (SOC \u0026amp; Incident Response) x 2\u003c/h2\u003e \u003cdiv class=\"meta\"\u003e \u003cul class=\"classifications\"\u003e \u003cli data-id=\"20749\"\u003e IT Security \u003c/li\u003e \u003cli data-id=\"20751\"\u003e Sydney \u003c/li\u003e \u003cli data-id=\"20752\"\u003e Permanent / Full Time \u003c/li\u003e \u003c/ul\u003e \u003cp class=\"date-posted\"\u003e 11/11/2026 \u003c/p\u003e \u003c/div\u003e \u003cul class=\"bullet-points\"\u003e \u003cli\u003ePermanent | Sydney CBD | Up to $170K + super | Hybrid after first 6 Months\u003c/li\u003e \u003cli\u003eTwo permanent seats at AVP level, one suited to someone ready to lead others.\u003c/li\u003e \u003cli\u003e4-day week: 9:00am to 7:30pm, Wed to Sat OR Sun to Wed | 1 Day a week WFH\u003c/li\u003e \u003c/ul\u003e \u003cdiv class=\"description\"\u003e Prefer working the case over building the tooling? This is a hands-on analyst role in a global cloud security operations team. You\u0026rsquo;ll own incidents yourself, dig through the logs, and explain what happened to the people who need to know.\u003cbr\u003e \u003cbr\u003e\u003cbr\u003e\u003cstrong\u003eWhat\u0026rsquo;s on offer\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eUp to $170K + super\u003c/li\u003e \u003cli\u003e4-day week, three days off\u003c/li\u003e \u003cli\u003eA cloud security operations team spread across Australia, Singapore, the US and Europe\u003c/li\u003e \u003cli\u003eA Sydney CBD office alongside around 40 people in the Sydney cyber team\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eThe team and the work\u003c/strong\u003e\u003cbr\u003e \u003cbr\u003eThe cloud security operations team identifies, investigates and responds to threats across the bank\u0026rsquo;s Azure, AWS, GCP and SaaS environments. You\u0026rsquo;ll report to a hiring manager in Singapore and work with 4 analysts there and 4 in Sydney.\u003cbr\u003e\u003cbr\u003e Day to day, you\u0026rsquo;ll:\u003cbr\u003e \u003cul\u003e \u003cli\u003eInvestigate alerts and incidents from triage through to closure, running them yourself\u003c/li\u003e \u003cli\u003eWork cases ranging from brute-force attempts and suspicious AI use to data exfiltration and CVE exploitation\u003c/li\u003e \u003cli\u003ePull and analyse logs in Splunk and Azure Log Analytics across all three clouds and SaaS\u003c/li\u003e \u003cli\u003eSpot unfamiliar data mid-incident and work out whether it matters\u003c/li\u003e \u003cli\u003eTune existing detections and build new ones\u003c/li\u003e \u003c/ul\u003e What you must-have:\u003cbr\u003e \u003cul\u003e \u003cli\u003e2 to 7 years as an analyst in a SOC or security operations role. This is an analyst role, not engineering\u003c/li\u003e \u003cli\u003eHands-on incident response in at least one of Azure, AWS or GCP\u003c/li\u003e \u003cli\u003eExperience working incidents end to end without supervision\u003c/li\u003e \u003cli\u003eLog analysis in a SIEM such as Splunk or Elastic\u003c/li\u003e \u003c/ul\u003e Desirable:\u003cbr\u003e \u003cul\u003e \u003cli\u003eIncident response across two or more of Azure, AWS and GCP, plus SaaS (AWS and Azure together is ideal)\u003c/li\u003e \u003cli\u003eAlert tuning in a cloud environment\u003c/li\u003e \u003cli\u003eScripting or programming experience\u003c/li\u003e \u003cli\u003eA large enterprise or banking background\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eAbout Decipher Bureau\u003c/strong\u003e\u003cbr\u003e \u003cem\u003eDecipher Bureau is Australia\u0026rsquo;s leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to find and secure exceptional talent. We don\u0026rsquo;t just match skills to a job description. We take the time to understand both the technical requirements of a role and the team environment, so every introduction we make is a considered one.\u003c/em\u003e\u003cbr\u003e \u003cbr\u003e\u003cbr\u003e\u003cstrong\u003eInterested?\u003c/strong\u003e\u003cbr\u003e If this sounds like your next move, click Apply or reach out for a confidential chat. There\u0026rsquo;s more detail on the team and environment that can be shared one on one.\u003cbr\u003e\u003cbr\u003e Kris Rosentreter, 0452 564 644\u003cbr\u003e kris@decipherbureau.com \u003c/div\u003e \u003cdiv class=\"apply\"\u003e \u003ca class=\"back-link\" href=\"#\" title=\"Back to search results\"\u003eBack to search results\u003c/a\u003e \u003cinput type=\"button\" class=\"ja-button\" data-job-id=\"4485596\" value=\"Apply Now\" title=\"Apply Now\" /\u003e \u003c/div\u003e \u003c/div\u003e "