Cybersecurity Expert

AARNet is seeking a skilled Threat Intelligence Engineer to safeguard the research and education community against malicious actors on the Internet.

This position plays a key role in designing and implementing threat insights, dashboards, and automated enrichments for cyber threat intelligence.

• Design and implement threat analysis strategies to proactively identify malicious activities within customers' environments based on observed data insights.
• Leverage SOC data feeds and third-party threat intelligence from government and commercial providers to derive actionable insights.

• Develop and continuously evolve our threat analysis strategies to stay ahead of emerging threats.
• Collaborate with the larger SOC team and customers to investigate and report malicious cyber activities, providing in-depth analysis for stakeholders.

• Work alongside data scientists, analysts, and the reporting manager to build prototypes, reports, and visualisations that illuminate emerging threats for the SOC and customers.
• Mine AARNet's unique position as an ISP to analyse large-scale Internet data and identify key trends, themes, and anomalies impacting the higher education sector.

• Contribute to the development of software and scripts that integrate and operationalise SOC datasets for threat hunting, vulnerability discovery, and other security missions.
• Expand our library of datasets (including new customer log sources, additional threat intelligence) and integrate new capabilities into existing tools and analytics platforms.

• Partner with SOC analysts, detection and automation engineers, and data parsing teams to ensure seamless data ingestion, normalisation, and correlation.
• Mentor junior staff members, sharing best practices and technical expertise, and foster a collaborative, knowledge-sharing culture.

• Investigate and explore emerging technologies, methodologies, and approaches for advanced threat detection and response.
• Cultivate a mindset of discovery to uncover the cyber threat landscape's 'emergent properties' so we can better predict and prepare for future threats.

• Solid understanding of cyber threats and the threat intelligence lifecycle, with proven experience in identifying, analysing, and mitigating malicious online activities.
• Experience working with security-oriented data sources (e.g., SIEM logs, threat intelligence platforms) and familiarity with data normalisation and correlation techniques.
• Hands-on experience in building or contributing to threat analysis and/or hunting programs, ideally within a SOC environment.
• Demonstrated proficiency with industry-standard TI frameworks and transport protocols—STIX/TAXII, MITRE ATT&CK and NIST CSF 2.0—using them as a common language for analytics and reporting.
• Strong communication skills and an ability to collaborate effectively across multidisciplinary teams.
• Bachelor's, Master's, or equivalent in Computer Science, Data Science, Cybersecurity, UX Design, or a related field, or 4+ years' work experience within a SOC or Security Threat Research environment
• Must be an Australian Citizen or Permanent Resident.

• Exposure to big data tools and platforms (e.g., Hadoop, Spark, Elasticsearch, or Kafka) for large-scale data analysis.
• Security-oriented and Problem-Solving Mindset – An innate curiosity for understanding why hackers hack, paired with a determined approach to preventing and detecting threats.
• Knowledge of machine learning or data mining techniques (anomaly detection, clustering, time-series analysis) to enhance threat detection.
• Leadership & Ownership – Ability to take accountability for designated tasks and guide initiatives from inception through to completion.
• Familiarity with data visualisation tools (e.g., Kibana, Grafana, Tableau) for surfacing insights tailored to various stakeholders.
• Mentoring – Willingness to share knowledge, coach junior team members, and inspire continuous learning within a cross-functional team.
• Prior experience in a research or academic environment, with an understanding of higher education cybersecurity challenges.
• Translation of Business Needs – Skilled at converting strategic or business objectives into technical requirements that drive impactful data and threat intelligence solutions.
• Proficiency in programming or scripting (e.g., Python, Shell scripting, or similar) to automate data analytics, parsing, and enrichment tasks.
• Attention to Detail – High level of diligence and consistency in handling configuration management, data quality, and process improvements.
• Collaboration & Influencing – Excellent interpersonal skills to work effectively across all levels of the organisation, with the capacity to communicate and present findings in a clear, succinct manner.
• NV1 or above Security Clearance.