Cyber Defence Technical Lead - Detection, Automation & Intelligence

Ramsay Health Care is seeking a senior, highly technical Cyber Defence Technical Lead – Detection, Automation & Intelligence to play a key role in protecting our digital environment, systems and patient data. Reporting to the SOC Manager, this hands-on technical leadership role will drive detection engineering, security automation and the ongoing health of telemetry across Ramsay’s hybrid Security Operations Centre (SOC). Acting as the technical 2IC, you will help shape the evolution towards an increasingly automated, agentic SOC, ensuring detection capabilities are continuously optimised, security technologies are seamlessly integrated, and emerging threats are identified and addressed effectively. Working across a large and complex healthcare environment, you will combine deep technical expertise with the opportunity to influence Ramsay’s cyber defence capabilities, strengthen operational resilience and protect critical information assets.

What You’ll Do

Your day-to-day responsibilities will involve, but are not limited to:

• Lead detection engineering, detection rule development and tuning, and continuous mapping to the MITRE ATT&CK framework.
• Design, develop and refine automated incident response playbooks and Security Orchestration, Automation and Response (SOAR) workflows.
• Monitor, baseline and audit log ingestion pipelines to maintain telemetry health, identify gaps and ensure consistent security visibility.
• Build and manage API integrations and telemetry connectors across Ramsay’s security technology stack.
• Operationalise threat intelligence to support proactive threat hunting and the development of autonomous, agentic SOC workflows.
• Act as the technical quality assurance lead for our Managed Security Service Provider (MSSP), validating escalations, assessing detection effectiveness and driving continuous improvement.
• Lead root cause analysis, threat modelling and post-incident engineering improvements to strengthen detection and response capabilities.
• Collaborate with internal technology teams and external security partners to improve the integration and effectiveness of security platforms.

What You’ll Bring

You are a highly technical cybersecurity professional with extensive experience in enterprise security operations, detection engineering and security automation. You bring a hands-on approach to solving complex technical challenges, a strong understanding of evolving cyber threats and the ability to translate security intelligence into effective detection and response capabilities.

You will bring:

• Extensive cybersecurity experience within a large enterprise environment.
• Strong hands-on experience across detection engineering, SIEM, EDR and SOAR platforms.
• Demonstrated experience designing, tuning and maintaining detection rules and security use cases.
• Experience developing automated incident response workflows and integrating security technologies through APIs.
• Strong technical knowledge of data parsing, log ingestion, telemetry pipelines and security monitoring.
• A sound understanding of the cyber threat landscape, adversary tactics, techniques and procedures (TTPs), and frameworks such as MITRE ATT&CK.
• Experience working with MSSPs, Managed Service Providers (MSPs) and hybrid SOC operating models.
• Strong analytical and problem-solving skills, with the ability to investigate complex incidents and drive technical improvements.

Desirable but not essential

• A degree in Cybersecurity, Information Technology or a related discipline.
• Experience working within healthcare, critical infrastructure or another highly regulated environment.
• Relevant technical certifications, such as GIAC Certified Detection Analyst (GCDA), GIAC Cyber Threat Intelligence (GCTI) or GIAC Certified Security Automation (GCSA).
• Hands-on experience with Python scripting, API orchestration and advanced security automation.

About Us

Founded in Australia in 1964, Ramsay Health Care is the nation’s largest private hospital operator and a recognised global leader in healthcare delivery. Across Australia, Ramsay operates 76 hospitals and 12 surgical centres, caring for more than 1.1 million patients each year with the support of over 30,000 dedicated professionals. Guided by our ethos, “People Caring for People,” we are committed to delivering exceptional patient care, building meaningful relationships, and driving continuous improvement and sustainable growth. In addition to our hospital network, Ramsay operates a growing community pharmacy network of more than 35 locations. Through our culture, The Ramsay Way, we place our people at the centre of everything we do—fostering collaboration, empowering teams, and achieving outstanding outcomes for patients and communities.

Benefits

• Competitive remuneration and a comprehensive range of employee benefits.
• Professional development and career progression opportunities.
• Access to Ramsay Rewards and exclusive retailer discounts.
• The opportunity to influence the evolution of cyber defence capabilities across a large, complex healthcare environment.
• A technically challenging role with scope to drive detection engineering, automation and next-generation SOC initiatives.

To Apply

All applications should include your CV outlining your experience and skills in line with the above criteria. Applications close Sunday 15th November 2026.

Please Note:

Ramsay Health Care is committed to Child Safety. Details of our commitment are set out in our Code of Conduct, available at www.ramsayhealth.com.au.

Applications made by recruitment agencies will not be considered.