Location & Work Model
- Sydney – Hybrid work model
- Competitive base salary + super + benefits
About Orro
We're an Australian success story, now close to 500 people strong, delivering secure, end to end digital solutions across cloud, collaboration, cyber security, data services and network infrastructure, all backed by over 20 years of experience. Trusted by some of Australia's biggest brands, Orro leads the way in designing, building and operating digital infrastructure that delivers greater efficiency, agility, performance and resilience. Our solutions take the stress out of tech for more than 400 businesses and over 20 million Australians every single day.
Our mission? To create "future now" solutions making it faster, simpler and safer for people to access, store and share information, wherever they are and whoever they're with. But more than that, we know that real impact comes from connecting people, not just machines. That's why we take the time to understand our clients; how they work, what matters to them, and where they're headed so we can deliver not just what they need today, but what they'll need next.
With offices in Sydney, Melbourne, Canberra, Brisbane and Perth, and teams across New Zealand, the Philippines and the UK, Orro is known for delivering future ready solutions, backed by deep expertise, genuine human insight and lasting partnerships.
Responsibilities
- Investigate SIEM events and own incident response from triage through escalation to resolution
- Analyse phishing activity, suspicious domains and IP addresses to identify genuine risk quickly
- Author reliable detections for defined behaviours across Microsoft Sentinel, SentinelOne and Splunk, applying thresholds, aggregation and suppression
- Tune routine rules to cut false positives without losing true positives, and document the rationale
- Build detections aimed at each customer's stated risks and most critical assets, and explain the why behind a rule in business terms
- Audit customer logging against intended coverage and flag concrete gaps with the impact of each
Requirements
Essentials
- 3 or more years in an enterprise scale security operations environment, including hands on incident response
- Hands on experience with modern detection and response tooling, including SIEM, XDR and EDR
- Experience writing or tuning detection rules in Microsoft Sentinel, SentinelOne or Splunk, using their query languages
- Solid grounding in Microsoft security technologies, with confidence working across Linux or Unix environments
- Working knowledge of MITRE ATT&CK, NIST and ISO 27000, and the ability to explain technical detail to technical and non technical audiences
Bonus Points
- Current certifications such as SC 200, Blue Team Level 1 or 2, SANS Incident Responder or GIAC GCDA
- Broad understanding of cloud, networking and firewall technologies
- Experience with vulnerability management tooling such as Rapid7, Tenable or Qualys
Even if you don't tick every box, don't let that hold you back. If this sounds like your kind of challenge, we'd genuinely love to hear from you.
Benefits
- Public holiday swaps that embrace family and cultural diversity
- Generous parental and caregiver leave
- Flexible work options
- Company wide mentoring
- Emerging Leaders Development Program
- 3 days of paid volunteer leave each year
- Novated leasing
- Employee discounts
- Full access to wellbeing platform with expert fitness plans, nutrition tips, and tools to help you feel your best
Important Notes
- Role is subject to state and federal police background checks
- Applicants must have the unrestricted right to work in Australia
- Visa sponsorship is not available for this position
Imported from Orro Pty Ltd’s job posting on orrogroup.teamtailor.com. Apply sends you to the original listing.