As the Senior Cyber Security Support Officer you will:
* Provide initial triage and response capabilities by reviewing events, resolve or escalated them as cyber security incidents, and assist with blast radius analysis, containment, eradication, and recovery actions if coordinated response is required.
* Assist in maintaining and improving TAFE Queensland's cyber security posture by identifying areas for improvement and addressing them with automation, configuration changes, or documentation.
This position reports to the Manager, Security Operations.
This is a Permanent, Full-Time opportunity.
The position will be based primarily at Mount Gravatt, however you may be required to perform work at other TAFE Queensland campuses.
Key Responsibilities
* Contribute to the time-sensitive detection, identification, and alerting of intrusions, anomalous and misuse activities across complex on-premise and cloud environments, and triage these events as either incidents or benign activities.
* Contribute to incident response activities, incident assessment and investigation, and reporting on cyber security breaches, ensuring identified security breaches are promptly and thoroughly investigated, including determining potential impact, performing root cause analysis and making recommendations on timely remediation.
* Support, build upon and enhance cyber security orchestration within the Microsoft and Azure security stack. This will include integrations into third‐party security solutions, business applications, and other cloud or on‐premise solutions.
* Perform operations and administrative activities for the security of the organisation, including event correlation, monitoring, research, assessment and analysis using enterprise security tools (SIEM, mail gateways, EDR/antivirus, and other cloud‐based systems).
* Contribute to proactive threat hunting activities; threat hunting activities, analysing, and responding to current, emerging and organisation‐specific threats based on private and public threat feeds or reports.
* Support the identification, escalation and resolution of gaps in visibility, intelligence and technology that could improve the efficiency or efficacy of the Cyber Security services.
* Improving upon existing documentation or creating documentation where required.
* Responsible handling of potentially sensitive information.
* Be the initial escalation point for other TAFE Queensland teams for any cyber security related queries. This includes security related technical discussions with other ICT teams, or non‐technical discussions with other business units.
* Organise, liaise, and support the delivery of TAFE Queensland's penetration testing function including application testing and purple team scenarios.
* Contribute to the success of transformation and cultural change through promoting and modelling the values of Safety First, Working Together, Focusing on our Customer, Taking Responsibility and Showing Initiative.
How you will be assessed
* Demonstrated knowledge across various ICT systems and concepts such as basic networking, Identity and Access Management, Software and Application Management, Microsoft 365, Entra ID, Windows Operating Systems, and Unix Operating Systems.
* Demonstrated experience working within a cyber security role involving the security monitoring of Microsoft Azure and Office 365 cloud‐based environments.
* Demonstrated experience in the Kusto Query Language or equivalent, and scripting language such as PowerShell or python in the context of automating tasks.
* Demonstrated experience in building on capabilities in next generation SIEM/SOAR solutions and have a clear vision and understanding of security orchestration.
* Strong written and verbal communication skills, with the proven ability to engage effectively at all levels of an organisation, including the ability to work effectively alongside outsourced delivery partners.
* Demonstrated ability to live and promote a strong ICT team culture that values the contributions of all team members, is honest and considerate, and through that is an active participant in building and maintaininga highly respected high‐performance team.
Highly desirable requirements
* Working knowledge of the importance of timely Cyber Security actions to address attacks.
* Knowledge of the various functions, common toolsets, and their purposes within a Security Operations.
* Knowledge of Microsoft Sentinel, Exchange Online Protection and Microsoft Defender for Endpoint is desirable.
* Industry knowledge of current risks, threats and systemic issues that organisations face, and what causes them.
* Possession of industry acknowledged Security certifications is valued, such as Microsoft SC-200, MS-500, AZ-500.
#J-18808-Ljbffr