Cyber Threat Investigator

Velan Consulting Pty Ltd - Direct supplier to both Federal and Private clients.
Lead Cyber Threat Analyst (Multiple roles) | Canberra - Hybrid | Australian Citizens with NV1 | Long-term Contract
Working arrangements : Hybrid
The Labour Hire Worker is expected to work onsite for the first 6 weeks before a hybrid flexible working arrangement can be considered.
Job details
Cyber Threat Analysts need to understand cyber intrusion activities then use their research skills to provide reporting on threat modelling and intelligence.
The Senior Cyber Threat Analyst with cyber threat hunting, malware analysis, AI engineering and incident response skillset and expertise who will be responsible for understanding cyber intrusion activities and applying technical analysis, research and investigative methods to identify, assess and report on malicious or suspicious activity affecting the agency. The role supports proactive threat hunting, incident response, and intelligence-informed analysis to strengthen the agency’s cyber defensive posture.
Key duties and responsibilities
Conduct proactive cyber hunt activities based on hypotheses, intelligence reporting, anomalous activity and identified risks.
Investigate cyber intrusion activity and suspicious behaviour across networks, systems and data sources.
Support incident response activities through technical triage, investigation, containment support and reporting.
Research adversary tactics, techniques and procedures and translate findings into threat modelling and actionable reporting.
Work closely with threat intelligence, detection, vulnerability management and other cyber teams to improve investigative outcomes and defensive uplift.
Document investigative findings, methods, artefacts and recommendations in a clear and defensible manner.
Contribute to knowledge transfer, mentoring and capability uplift of APS staff within the Hunt and Incident Response function.
Ability to work across multiple cyber disciplines and contribute to technically complex operational outcomes.
Manage intrusion and analysis work with the ability to make decisions on appropriate response and escalate as necessary.
Manage complex threat intelligence/modelling tasks and/or threat assessments.
Manage major Information Security incidents.
Assist with corporate response to an Information Security incident.
Identifies and implements improved controls to reflect changes in factors such as threat levels and legislation.
Undertake advanced research into vulnerabilities or cryptography, including producing complex exploits, undertake effective reverse engineering and/or effectively researched mitigation bypasses.
Analyse security risks, identify control deficiencies, develop remediation strategies and implement security engineering solutions within large and complex ICT environments.
Technical skills (continued)
Understanding of investigation and forensic techniques and tools.
Design, code, verify, test, document, amend and refactors moderately complex programs/scripts.
SFIA:
Intrusion Detection and Analysis level 5
Threat Intelligence, Assessment and Threat Modelling level 5
Research level 4
Risk Assessment level 5
Essential Technologies:
Microsoft Defender
Query tables within Advanced Hunting (using KQL) to identify logs that answer investigative questions i.e. Network Events, Email Events, and Device File Events.
Create and store custom playbooks.
Elastic
Use Kibana Endpoint, Events, NET and TI feeds to identify logs that answer investigative questions, using KQL Lucene and/or ES|QL queries.
Navigate dashboards, review and respond to security alerts, imported from Microsoft Defender and Qradar.
GatewayPE - Extrahop:
Identify Communications from hosts to external IPs and domains.
Search Extrahop to identify if malicious domains have reached endpoints.
Use available data to extrapolate the nature of network communications from hosts and enemy domains & IPs.
Log02:
Use Linux command line skills to navigate through log02 files, such as windows event and firewall logs.
AUPDNS
Use Threat Intelligence to interrogate potential communication with suspicious domains.
Highly Desirable technologies:::
Engine Server
FlareVM
Malware Analysis tools
HxD
Pestudio
Sysinternal
QRadar
Windows Server
Linux
Active Directory
Microsoft Entra ID.
Identity and Access Management (IAM) technologies.
Security Information Event management (SIEM) platforms:
Microsoft Sentinel or equivalent.
Security Orchestration, Automation and Response (SOAR) platforms.
Vulnerability management platforms:
Rapid7
Tenable
Microsoft Defender.
Endpoint Detection and Response (EDR) technologies.Cloud platforms:
Microsoft Azure
Amazon Web Services
Google Cloud Platform
Network, firewall and infrastructure security technologies.
Infrastructure hardening and security baseline implementation.
Security automation and scripting:
PowerShell
Python.
Security architecture and systems integration concepts.
Knowledge / Qualifications
Relevant tertiary qualifications, industry certifications or equivalent practical experience in cyber security will be regarded favourably
Relevant experience in cyber security operations, cyber threat analysis, incident response, digital forensics and threat hunting is required.
Other required cyber security knowledge and experience:
Protective Security Policy Framework (PSPF)
Information Security Manual (ISM)
Essential Eight Strategies
National Institute of Standards and Technology (NIST)
Appropriate and relevant certifications including:
CREST Certified Network Intrusion Analyst,
CREST Certified Host Intrusion Analyst,
CREST Certified Malware Reverse Engineer.
Technical skills
Essential Technical skills and knowledge: • Cyber threat hunting • Cyber incident investigation, or cyber security operations. • Analyse logs, artefacts and system data to identify indicators of compromise, anomalous behaviour and intrusion activity. • Understanding of attacker tactics, techniques and procedures and how they are applied in an enterprise environment. • Technical reporting, investigative outputs and intelligence-informed assessments.
Essential criteria
1.Demonstrated ability leading hunt and analysis of cyber threats: • Identifies threats within research conducted or provided. Constructs Hunt exercises based on research which apply to the agency, and agency systems. • Identifies ICT critical assets (e.g. endpoints, servers, gateways) using technical tools and network maps. Contextualizes why assets are important.
2.Demonstrated ability to lead, engage, influence, communicate and collaborate with a broad range of stakeholders, including senior executives, technical specialists, business representatives, other government agencies/departments and external providers.
3.Demonstrated and proven experience performing the duties and responsibilities relevant to the role being applied for, including the required technical skills, technologies, frameworks and methodologies identified in the RFQ.
4.Demonstrated understanding and practical application of cyber security operations and risk management principles, including threat detection, hunting and analysis, security monitoring, threat intelligence, vulnerability management, incident response and relevant Australian Government security frameworks such as the PSPF, ISM and Essential Eight.
5.Demonstrated ability to communicate complex technical and cyber security concepts to both technical and non-technical audiences and contribute to capability uplift through mentoring, collaboration and knowledge transfer activities.
Desirable criteria
1.Experience working within large-scale enterprise environments involving cloud platforms, identity and access management, security operations, infrastructure, applications and data services.
2.Demonstrated ability to deliver outcomes within tight timeframes while managing competing priorities, dependencies and stakeholder expectations.
3.Demonstrated and proven experience performing the duties and responsibilities relevant to the specialised sub role (Senior Cyber Threat Hunter, Senior Malware Analyst, Senior AI Engineer), including the required technical skills, technologies, frameworks and methodologies identified/applicable.
4.Demonstrated experience identifying, assessing and managing cyber security risks, vulnerabilities, compliance obligations and remediation activities. Demonstrated experience engineering threat analysis tool integrations across a broad enterprise security ecosystem, including technologies such as threat intelligence platforms, endpoint or network detection and response, identity and access management, vulnerability management, cloud security, firewalls and case management. Demonstrated experience designing continuously improving cyber security automation within a lar

Work arrangement
Yes