About this role
About the Role
We are seeking an experienced L3 Security Engineer to lead security engineering, architecture, and continuous improvement across multiple customer environments within a Managed Service Provider (MSP).
This senior technical role goes beyond security monitoring and alert triage. You will design and implement security controls, lead vulnerability remediation, strengthen compliance, resolve complex security incidents, and establish consistent security standards across customer environments.
Working closely with infrastructure teams, service desk engineers, Account Managers, and customers, you will take ownership of security outcomes while mentoring junior engineers and driving a proactive approach to cybersecurity.
About the Client
You will be working with a technology and managed services provider supporting multiple customer environments. The organisation is focused on strengthening cybersecurity, improving service delivery, and developing scalable security standards that help customers reduce risk and maintain resilient IT environments.
Ideal Profile
Technical Expertise
Significant experience within an MSP, MSSP, or IT Service Provider environment
Strong hands-on experience with Microsoft Defender and its security ecosystem
Advanced experience with Sophos Firewall and endpoint security technologies
Proven experience managing vulnerability and patch management programs
Experience implementing security controls across Microsoft 365 environments
Strong knowledge of Microsoft Entra ID and Zero Trust security principles
Solid understanding of networking fundamentals, including TCP/IP, DNS, DHCP, VLANs, routing, firewalls, VPNs, and network segmentation
Strong Windows Server and endpoint troubleshooting capabilities
Experience handling complex technical escalations and leading remediation activities
Ability to design and implement practical security improvements rather than simply identify risks
Security Platforms & Technologies
Hands-on experience with ConnectSecure and Huntress is highly desirable
Experience with Sophos ZTNA, Microsoft Intune, Microsoft Defender XDR, and Conditional Access is advantageous
Familiarity with Microsoft Defender for Endpoint, Office 365, Identity, and Vulnerability Management
Knowledge of Essential Eight, CIS Controls, NIST Cybersecurity Framework, and ISO 27001
PowerShell scripting and API-based automation experience is beneficial
Familiarity with MSP PSA platforms such as HaloPSA, ConnectWise, or Autotask
Relevant Microsoft, Sophos, or cybersecurity certifications are advantageous
Security Architecture & Compliance
Experience assessing security architectures and identifying technical weaknesses
Ability to translate compliance requirements into practical security controls
Strong understanding of cybersecurity threats, attack techniques, and defensive measures
Experience developing remediation strategies, security baselines, and technical standards
Ability to prioritise vulnerabilities based on exploitability, exposure, asset criticality, and business impact
Leadership & Communication
Strong written and verbal English communication skills
Excellent technical documentation and reporting capabilities
Ability to lead complex remediation activities and provide technical direction
Confidence making technical decisions and challenging inadequate security practices
Strong problem-solving skills and a methodical approach to incident investigation
Ability to remain calm during critical incidents while considering customer priorities and operational impact
A proactive mindset focused on root causes, automation, standardisation, and preventing recurring issues
Responsibilities
Security Architecture & Technical Leadership
Act as a senior technical authority for security across multiple customer environments
Design, review, and improve customer security architectures
Establish security standards, recommended configurations, and repeatable best practices
Identify architectural weaknesses and develop remediation roadmaps for complex or high-risk issues
Review security solution designs and support customer onboarding, migrations, and major infrastructure changes
Mentor L1 and L2 engineers and strengthen internal security capabilities
Lead complex security escalations and configuration investigations
Microsoft Defender
Administer, configure, and optimise Microsoft Defender security solutions across customer environments
Design and implement Defender policies and standard configurations
Configure and maintain Attack Surface Reduction rules, endpoint detection and response, automated investigation, web filtering, endpoint firewall policies, device control, antivirus, and tamper protection
Investigate complex security incidents involving endpoints, identities, email, and cloud environments
Use Microsoft Defender XDR to conduct advanced threat analysis
Review Secure Score, vulnerability data, and security exposure to identify improvement opportunities
Support migrations from third-party endpoint security platforms where appropriate
Identify opportunities to improve Microsoft licensing utilisation and security capabilities
Sophos Firewall & Endpoint Security
Provide senior technical support and architecture guidance across Sophos security environments
Design and review firewall deployments and establish standard configuration baselines
Configure and optimise firewall rules, network segmentation, NAT, intrusion prevention, web filtering, application control, VPNs, SD-WAN, high availability, logging, and monitoring
Troubleshoot complex firewall, connectivity, and endpoint security issues
Review configurations for security weaknesses and unnecessary exposure
Manage Sophos Central and endpoint security policies
Support firmware upgrades, migrations, firewall refreshes, and security platform consolidation
Zero Trust Network Access
Design, implement, and maintain Zero Trust Network Access (ZTNA) solutions
Develop secure application access models based on user identity, device health, application requirements, location, authentication risk, and access needs
Apply least-privilege principles and integrate ZTNA with Microsoft Entra ID
Reduce reliance on traditional VPN technologies where appropriate
Troubleshoot complex ZTNA and authentication issues
Assess existing remote access environments and develop Zero Trust migration strategies
Establish repeatable ZTNA deployment standards across customer environments
Vulnerability Management
Own and improve the vulnerability management approach across customer environments
Review ConnectSecure findings and prioritise remediation based on exploitability, internet exposure, asset criticality, and business impact
Lead remediation of critical vulnerabilities and investigate recurring issues
Develop remediation strategies involving patching, configuration changes, network segmentation, application upgrades, compensating controls, firewall changes, platform migrations, or software replacement
Identify unsupported and end-of-life systems and develop remediation or replacement plans
Track unresolved vulnerabilities and ensure appropriate risk decisions are made
Validate remediation through rescanning and verification
Develop vulnerability dashboards, reporting, remediation standards, and technical security roadmaps
Huntress Security
Provide senior-level support for Huntress deployments across customer environments
Investigate advanced detections and SOC escalations
Analyse persistent footholds, suspicious applications, and unusual system activity
Ensure agents and services are deployed correctly and endpoints are appropriately protected
Assess SOC recommendations and coordinate suitable technical responses
Identify recurring trends and use findings to strengthen security standards
Establish processes for resolving escalations within agreed timeframes
Patch Management
Provide technical oversight of operating system and application patch management
Define and optimise patching standards and review compliance across customer environments
Investigate systemic patching failures and complex Windows Update or application patching issues
Develop strategies for critical and zero-day vulnerability remediation
Ensure critical security patches are deployed within agreed service-level agreements
Identify systems and applications that cannot be reliably patched and develop alternative remediation or upgrade plans
Coordinate patching for servers and critical business systems
Monitor supported operating system versions and end-of-life dates
Identify opportunities to improve patching through automation and technology refresh initiatives
Compliance Management & Remediation
Lead technical initiatives to improve customer security compliance
Assess environments against relevant frameworks, including Essential Eight, CIS Controls, NIST Cybersecurity Framework, ISO 27001, and cyber insurance requirements
Identify compliance gaps and develop practical remediation strategies
Implement or oversee required security controls and maintain progress through to completion
Assist with audit evidence collection and customer security assessments
Develop security baselines, technical policies, and configuration standards
Recommend alternative controls where compliance requirements cannot be met directly
Identity & Access Security
Design and improve identity security controls across customer environments
Review Microsoft Entra ID configurations and implement Conditional Access, multi-factor authentication, Privileged Identity Management, and secure authentication methods
Manage role-based access, administrative accounts, device compliance, and privileged permissions
Identify excessive access and implement least-privilege controls
Investigate complex authentication and access incidents
Support compromised identity investigations and establish standard identity security configurations
Endpoint Security & Hardening
Design and maintain secure endpoint configurations and security baselines
Ensure security controls are deployed consistently across devices
Manage security integration across Microsoft Defender, Sophos Endpoint, Huntress, Microsoft Intune, and Microsoft Entra ID
Implement device hardening, endpoint encryption, BitLocker, and application control where appropriate
Review Attack Surface Reduction policies and local administrative privileges
Identify unmanaged or non-compliant endpoints and develop remediation plans for legacy devices
Security Incident Escalation
Lead technical investigations into complex security incidents
Coordinate containment, remediation, endpoint isolation, and account protection
Determine incident scope, affected systems, root causes, persistence, and potential lateral movement
Collaborate with third-party SOCs, vendors, and internal engineers during incident response
Support customer communications and provide clear technical guidance
Develop post-incident recommendations to reduce the risk of recurrence
Security Automation & Continuous Improvement
Identify opportunities to automate recurring security activities
Use PowerShell, APIs, and other automation technologies to improve security operations
Automate security configuration checks and appropriate vulnerability remediation workflows
Develop reusable deployment processes, internal tools, scripts, and templates
Improve documentation and standardise security processes across customer environments
Turn recurring incidents and vulnerabilities into improvements in architecture, automation, and security standards
MSP Service Delivery & Customer Engagement
Support multiple customer environments and act as a senior escalation resource for service desk and infrastructure teams
Manage complex security incidents and projects through the PSA platform
Maintain detailed technical documentation and participate in solution design and technical reviews
Assist with customer onboarding, security assessments, and pre-sales activities for security projects and managed security services
Work with Account Managers and vCIOs to develop customer security roadmaps and estimate remediation effort
Participate in customer security reviews and strategic technology discussions
Explain security risks and recommendations in clear business language
Help customers prioritise security investments and understand the impact of unresolved vulnerabilities
Build customer confidence through accountability and ownership of security outcomes
How we take care of our team
💰 Get paid in Australian Dollars 🏥 Medical insurance from day one for you + spouse (or parents if unmarried) 🩺 Generous OPD coverage from doctor visits to all your medical needs 🏡 Home office setup allowance to build your ideal workspace 🌐 Internet allowance to keep you connected 💪 Gym & wellness allowance to stay fit and balanced 🎉 Work hard, play hard – regular team events & engagement activities 🧠 Diji Assist – Mental health & counseling support when you need it 📚 We invest in you – reimbursement for industry certifications 🗣️ Open-door culture – your ideas and feedback always matter 🌍 Flexible work – home or office, wherever you do your best work 🏆 Rewards & recognition that actually recognize you 🥳 Great christmas & financial year-end parties to unwind with your loved ones