{"id":4080534,"url":"https://alion.io/job/orro-cyber-security-analyst","title":"Cyber Security Analyst","company":{"id":696217,"name":"Orro","domain":"orro.group","url":"https://alion.io/company/orro-2","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia","Melbourne, Australia","Brisbane, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Unix","optional":false},{"name":"Qualys Cloud Platform","optional":true}],"status":"live","first_seen_at":"2026-11-11T01:40:41Z","employer_posted_date":"2026-11-11","last_verified_at":"2026-11-11T23:40:11Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Sydney | Melbourne | Brisbane | Hybrid Work Model | Competitive base + super + benefits\nMost cyber security analyst roles keep you working one platform's alert queue and hand the detection work to someone else. This one puts you across Microsoft Sentinel, SentinelOne and Splunk, on customer environments that are never the same twice, and gives you a real hand in writing and tuning the detections you triage. As a Cyber Security Analyst in our cyber security team, you'll investigate and respond to security events for some of Australia's biggest brands while building the detection content that keeps them protected. If you are ready to take on more, not just more of the same, this is the role.\nAbout Orro\nWe're an Australian success story, now close to 500 people strong, delivering secure, end to end digital solutions across cloud, collaboration, cyber security, data services and network infrastructure, all backed by over 20 years of experience. Trusted by some of Australia's biggest brands, Orro leads the way in designing, building and operating digital infrastructure that delivers greater efficiency, agility, performance and resilience. Our solutions take the stress out of tech for more than 400 businesses and over 20 million Australians every single day.\nOur mission? To create \"future now\" solutions making it faster, simpler and safer for people to access, store and share information, wherever they are and whoever they're with. But more than that, we know that real impact comes from connecting people, not just machines. That's why we take the time to understand our clients; how they work, what matters to them, and where they're headed so we can deliver not just what they need today, but what they'll need next.\nWith offices in Sydney, Melbourne, Canberra, Brisbane and Perth, and teams across New Zealand, the Philippines and the UK, Orro is known for delivering future ready solutions, backed by deep expertise, genuine human insight and lasting partnerships.\nWhat You'll Be Doing\nYou'll join our cyber security team, working across daily operations, detection and continuous improvement for a broad customer base. Your week moves between triaging and resolving live events and improving the detections that catch the next one, whether that is writing a new rule, tuning a noisy one or tracing a coverage gap back to a missing log source. You'll work closely with fellow analysts, threat hunters and customer stakeholders, both remotely and onsite. There is real scope here to shape how we detect, not just how we respond.\nInvestigate SIEM events and own incident response from triage through escalation to resolution\n\nAnalyse phishing activity, suspicious domains and IP addresses to identify genuine risk quickly\n\nAuthor reliable detections for defined behaviours across Microsoft Sentinel, SentinelOne and Splunk, applying thresholds, aggregation and suppression\n\nTune routine rules to cut false positives without losing true positives, and document the rationale\n\nBuild detections aimed at each customer's stated risks and most critical assets, and explain the why behind a rule in business terms\n\nAudit customer logging against intended coverage and flag concrete gaps with the impact of each\n\nWhat You'll Bring\nThe Essentials\n3 or more years in an enterprise scale security operations environment, including hands on incident response\n\nHands on experience with modern detection and response tooling, including SIEM, XDR and EDR\n\nExperience writing or tuning detection rules in Microsoft Sentinel, SentinelOne or Splunk, using their query languages\n\nSolid grounding in Microsoft security technologies, with confidence working across Linux or Unix environments\n\nWorking knowledge of MITRE ATT&CK, NIST and ISO 27000, and the ability to explain technical detail to technical and non technical audiences\n\nBonus Points\nCurrent certifications such as SC 200, Blue Team Level 1 or 2, SANS Incident Responder or GIAC GCDA\n\nBroad understanding of cloud, networking and firewall technologies\n\nExperience with vulnerability management tooling such as Rapid7, Tenable or Qualys\n\nEven if you don't tick every box, don't let that hold you back. If this sounds like your kind of challenge, we'd genuinely love to hear from you.\nWhy Orro?\nAt Orro, we're proud to support our people and the people who matter most to them in meaningful and inclusive ways. From public holiday swaps that embrace family and cultural diversity, to generous parental and caregiver leave, flexible work options, and company wide mentoring, we're here to help you thrive at every stage of life. We also invest in the future through our Emerging Leaders Development Program, nurturing the next generation of talent from within. On top of that, you'll enjoy 3 days of paid volunteer leave each year, novated leasing, employee discounts, and full access to our wellbeing platform packed with expert fitness plans, nutrition tips, and tools to help you feel your best, inside and out.\nNote: The role is subject to state and federal police background checks. Applicants must have the unrestricted right to work in Australia. Visa sponsorship is not available for this position.","description_format":"text","description_chars":5167,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Hybrid work"],"hiring_locations":[{"name":"Australia","iso":"AU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Managed Network Services","Information Security","Managed IT Services (MSP)"],"lifecycle":[{"event":"open","at":"2026-11-11T17:04:09Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":28,"reasons":["conf:10","win:early"],"computed_at":"2026-11-12T09:43:22Z"},"pay":null,"html_url":"https://alion.io/job/orro-cyber-security-analyst","json_url":"https://alion.io/job/orro-cyber-security-analyst.json","meta":{"generated_at":"2026-11-12T09:43:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19767,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":696217},"rest":"https://alion.io/mcp/rest/get_company?id=696217"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Forro-cyber-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Forro-cyber-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Forro-cyber-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/orro-cyber-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Forro-cyber-security-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4080534}},{"tool":"search_jobs","arguments":{"company":"orro.group","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4080534},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}