Staff Security Engineer (Detection)

We’re taking an engineering-led approach to security operations, building internal capability and technical depth. You’ll provide technical accountability for REA’s detection-engineering capability and help shape how we evolve detection and automation Permanent role based either onsite in Melbourne or Sydney as well as open to remote in other locations We're REA With bold and ambitious goals, REA Group is changing the way the world experiences property. No matter where you're at on your property journey, we're here to help with every step - whether that's finding or financing your next home. Our people are the key to our success. At the heart of everything we do, is a thriving culture centred around high performance and care. We are purpose driven and collaborative, which drives innovation and our ability to make a real impact. As such, we’re proud to have been named one of Australia’s Best Workplaces four times since 2021 — including third place in 2025 — plus Best Workplace for Women in 2023 and Best Workplace in Technology in 2024 and 2025. These listings are testament to every person who helps make REA a great place to work. Where the team fits in The Detection & Response team helps REA identify, investigate and respond to cyber threats across our environment. The team monitors security signals, validates alerts, investigates suspicious activity and leads or supports coordinated incident response, including technical investigation and containment in partnership with engineering teams. With an increasing focus on detection and response engineering, the team continually strengthens REA’s ability to spot threats earlier, reduce the impact of incidents and learn from events to improve our security posture. What the role is all about The Staff Security Engineer is a key role in the Detections & Response team that will provide technical accountability for REA’s detection engineering capability within our purpose-built detection platform. You’ll shape standards, technical direction and the capability model across data flows, detection requirements, testing and response automation. Working within our strategic goals, you'll partner with the team to prioritise and sequence the work that delivers them, bringing deep technical expertise to guide how we get there. Day to day of the job Identify, initiate and lead long-term, cross-team initiatives that strengthen REA's detection and response capability, aligning stakeholders and driving delivery in partnership with Product, Platform and Engineering teams. Configure and operate the detection platform and its data flows, including log ingestion, transformation, alert enrichment and response automation, while shaping the technical standards and patterns used to define and validate detections. Define detection patterns and technical approaches to identify malicious activity across our environment, and lead the review, tuning and validation of high-fidelity detections and correlation logic that improve coverage, reduce false positives and enable the team to scale detection engineering capabilities. Build and maintain automated pipelines, infrastructure, tests and quality gates that validate detections and protect against configuration drift, regressions and coverage gaps. Analyse security events and logs to identify malicious activity, patterns and emerging attack techniques during investigations and proactive threat hunting Assess threat intelligence, attacker techniques and relevant industry frameworks in the context of REA’s environment, using them to set detection priorities and guide refined detection patterns that continuously improve coverage and signal quality. Investigate security alerts and incidents, independently determine whether containment is required, coordinate technical response activities and communicate effectively with the wider incident response team, senior management and business stakeholders as needed Produce and automate response playbooks to ensure rapid and effective containment and response Contribute to purple-team exercises and security testing to validate effectiveness of detections and identify gaps Partner with Product, Platform and Engineering teams to ensure new systems and changes have appropriate logging, monitoring and detection coverage Evaluate and use AI-assisted and other emerging tooling to improve detection, support investigations and response automation, applying sound security judgement and attacker-technique knowledge to guide investigative tasks and validate outputs. Mentor and share knowledge with other Security and Engineering team members through reviews, pairing and internal forums Who we’re looking for Ability to define detection engineering architectures, patterns and standards across multiple platforms, balancing detection coverage, signal quality, cost, performance, and operational impact Strong understanding of cloud and application architectures, including logging, monitoring, native security controls and common failure modes, with ability to translate these into detection and response requirements Proficiency in log analysis, scripting and query languages to investigate security events and evaluate detection behaviour, with the ability to define requirements for, review and validate complex detection logic, including edge cases and performance considerations. Capability to configure and manage data pipelines, including log forwarding, transformation, cost-conscious ingestion strategies, and observability pipeline tools Deep understanding of security observability tooling including EDR, SIEM, CNAPP, SOAR, and identity platforms, with ability to leverage their telemetry for high-fidelity detections Strong knowledge of attacker techniques and kill-chain concepts (e.g. MITRE ATT&CK) and how to map them into effective detections and coverage assessments Strong understanding of modern DevOps and systems-engineering practices, including detection-as-code, source-control workflows, infrastructure-as-code and CI/CD pipelines, with the ability to define standards and quality controls for building, testing, deploying and operating security tooling. Ability to build automation workflows for security operations, including SOAR platforms and response orchestration, and document operational procedures through playbooks, runbooks and detection test cases The REA experience The physical, mental, emotional and financial health of our people is something we’ll never stop caring about. This is a place to learn and grow. Some of our Perks & Benefits include: A hybrid and flexible approach to working Flexible leave options including, birthday leave and purchase additional leave Flexible parental leave offering for primary and secondary carers Our Because We Care program offers employees volunteering leave, community grants, matched payroll giving and our Community Café donates 100% of revenue to charity Hackdays so you can bring your big ideas to life Our commitment to Diversity, Equity, and Inclusion We are committed to providing a working environment that embraces and values diversity, equity and inclusion. We believe teams with diverse ideas and experiences are more creative, more effective and fuel disruptive thinking. If you've got the skills, dedication and enthusiasm to learn but don't necessarily meet every single point on the job description, please still get in touch. Join our Talent Neighbourhood Keen to be part of REA but didn't find a perfect match with this opportunity? Perhaps the timing isn't right? You should join our Talent Neighbourhood! #LI-REMOTE #LI-HYBRID