1 Principal Security Engineer Cyber Advisor

Cyber Advisors provide ICT security advice and assistance to government, including policy creation, project advice and assistance, and research.

Key duties and responsibilities

The Services, delivered in collaboration with and under supervision by nominated AFP personnel, include, but are not limited to, the following:

• Design and implement onboarding of log sources into the SIEM from cloud, on-premise, identity, endpoint, and network platforms

• Develop and maintain parsing, normalisation, and data quality standards for logs

• Build and maintain SOAR workflows to automate alert triage, enrichment, containment, and response

• Integrate SIEM and SOAR platforms with security and IT tooling including EDR, IAM, ticketing, email, firewall, and threat intelligence systems

• Develop, tune, and maintain high-quality detection rules aligned to threat detection capability, attacker techniques and organisational risk.

• Create and maintain SOC playbooks and operational runbooks mapped to automated workflows

• Reduce false positives and improve alert fidelity through continuous tuning and enrichment

• Support incident response through log analysis, detection insights, and rapid rule development

• Conduct detection gap analysis following cyber events, incidents, and threat intelligence updates

• Maintain performance, reliability, and configuration of SIEM/SOAR platforms

• Implement dashboards for monitoring and health checks for the SIEM/SOAR platforms

• Develop and maintain clear, accessible documentation for analysts, and capture system knowledge to support ongoing operations and knowledge transfer.

• Define and report on key detection and response performance metrics (e.g. MTTD, MTTR, alert quality, automation or MITRE coverage) to assess effectiveness and inform continuous improvement initiatives.

As part of the services, the seller must ensure the specified personnel

• Maintains currency in information technology processes and technical knowledge through ongoing professional development.

• Establishes and maintains effective business relationships and professional networks.

• Contributes to and implements improved ICT practices and procedures.

• Provides mentoring, coaching and training.

• Works effectively in a small team environment, and wider Command environment.

• Remains accountable for accurate completion of work within timeframes and quality requirements, shares own expertise with others and guides and mentors less experienced buyer employees; and

• Records and maintains files/information in accordance with buyer requirements.

AFP Work Level Standards 

AFP Band 8 Work Level Standards to apply.

The AFP reserves the right to engage further suppliers for the same services if required utilising this RFQ. Any offer of engagement will be made within 6-months of the RFQ release date.

Technical skills

Technical skills candidates would need to have (including but not limited to) are listed below:

• Demonstrated hands-on experience as a tech lead implementing and administering enterprise SIEM platforms such as Microsoft Sentinel/Windows Defender, IBM Qradar, Elastic or Splunk with strong experience in automation, writing complex queries, correlation rules, parsers and developing SOC playbooks
  Proven ability to optimise and integrate SIEM platforms, reduce false positives and improve alert quality

•