Cyber Security Engineer

Triskele Labs is one of the largest independent, sovereign cybersecurity providers of scale in Australia. While others have been acquired or taken private equity, we've stayed our own. We defend Australian organisations every hour of every day, and we're looking for a Security Engineer who can deploy, maintain and uplift the security platforms that defend modern organisations: AWS, Azure, Microsoft Sentinel, Microsoft Defender, CrowdStrike and Rapid7.

The Role

This is a hands-on engineering role at the centre of how we protect our clients. You'll deploy, maintain and continually uplift the security platforms across their environments: Microsoft Sentinel and Defender, CrowdStrike, Rapid7, AWS and Azure. From standing up a new tenant to keeping a mature estate healthy and hardening it over time, you own the engineering that makes these tools work in the real world. You'll sit alongside our SOC and consultants, translating client needs into well-built, well-maintained, resilient defences.

If you hold AZ-500, you're fluent in Microsoft security, and you've got real range deploying and maintaining across the wider toolset, this one is built for you.

What you'll do

• Deploy and onboard security platforms into client environments: Microsoft Sentinel, Defender, CrowdStrike and Rapid7, integrated, configured and production-ready.
• Connect data sources and build out log ingestion so the right telemetry flows into the right place.
• Maintain and operate the estate: health monitoring, updates, configuration management and the day-to-day BAU that keeps platforms performing.
• Uplift maturity over time: harden configurations, close posture gaps and migrate clients onto better-engineered standards.
• Engineer and harden cloud across AWS and Azure.
• Automate deployment and maintenance toil with scripting and infrastructure-as-code where it helps.
• Document the standards, runbooks and reference architectures that let us deploy and maintain consistently at scale.

What you'll bring

• Heavy, hands-on Microsoft security experience across Sentinel and Defender, with AZ-500 in hand.
• Real depth deploying and maintaining across the wider stack: CrowdStrike, Rapid7, AWS and Azure. We run the whole lot, and you should be comfortable across it.
• A track record of standing platforms up cleanly and keeping them healthy, not just configuring once and walking away.
• Solid cloud security fundamentals across both AWS and Azure.
• Scripting and automation chops: PowerShell, Python, KQL or similar.
• The instinct to dig into a problem until it's genuinely solved, not just closed.

Nice to have

• Further certifications across the stack: SC-200, AZ-104, AWS Certified Security Specialty, or CrowdStrike and Rapid7 product certifications.
• Splunk experience.
• MSSP, SOC or MDR experience.
• Infrastructure-as-code for repeatable, consistent deployments.

Why this role

• Real engineering, real impact. The platforms you deploy and maintain protect Australian organisations against live threats, not hypotheticals.
• Work across the best tools in the business. You won't be boxed into one vendor. You'll deploy, run and uplift the full stack that defends modern organisations.
• AI-forward by default. We build with AI across the business and expect our engineers to use it to move faster and think bigger.

To Apply

Send your CV and one deployment, automation or piece of security engineering you've delivered that you're proud of, with a short note on the problem it solved.