Security Architect - Security Operations

About Skillfield

Skillfield is a specialist technology consultancy operating at the intersection of cyber, data and AI. We partner with enterprise clients to protect, transform and enable their organisations through thoughtful, outcome-focused solutions. Our reputation is built on impact, not effort.

The role

Location: Melbourne, hybrid

Contract: Full-time, permanent or contract

We're looking for a Security Architect to design modern security operations for our clients. Security operations centres (SOCs) are drowning in alerts, and artificial intelligence (AI) agents can now triage, investigate and respond alongside human analysts. You'll design the platforms that make that safe, measurable and genuinely useful, and you'll build the AI agents that prove it works.

You'll own solution design for Skillfield's security operations and continuous threat exposure management (CTEM) offerings. That means architecting how security information and event management (SIEM), security orchestration, automation and response (SOAR), extended detection and response (XDR) and AI agents work together, with a CTEM platform telling the SOC which exposures matter most. You'll work with clients from first conversation to delivery, and with our engineers to turn designs into working solutions.

What you'll do

• Design SOC architectures across SIEM, SOAR and XDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, Google Security Operations or Cortex XSOAR
• Design and build AI agents that handle triage, enrichment, investigation and response, and integrate them with SIEM, SOAR, ticketing and threat intelligence platforms
• Integrate vendor AI agents such as Microsoft Security Copilot into client SOCs, and connect agents to security tools through application programming interfaces (APIs) and the Model Context Protocol (MCP)
• Define guardrails for autonomous response: what agents can do on their own, what needs human approval, how agent identities and permissions are scoped, and how every action is logged and auditable
• Design CTEM programs that bring together vulnerability management, attack surface management, cloud security posture and breach and attack simulation, and use them to prioritise what the SOC acts on
• Lead discovery and solution workshops with client SOC leaders, security architects and executives, and translate operational pain into practical designs
• Shape proposals, estimates and statements of work alongside our sales team, and present solutions clearly and credibly
• Build proofs of concept hands-on, including detection content, automation playbooks and AI agent workflows, to validate designs and de-risk delivery
• Act as design authority during delivery, guiding engineers and making the calls when trade-offs arise
• Define the metrics that prove value, such as mean time to detect and respond, analyst workload, AI agent accuracy and exposure reduction

About you

• Substantial experience as a security architect or senior security engineer, with a strong grounding in security operations
• Hands-on experience designing and implementing SIEM and SOAR platforms, including detection engineering and automation playbooks
• Experience with Microsoft Sentinel, Microsoft Defender XDR and Azure Logic Apps; experience with Splunk or Google Security Operations is a plus
• Practical experience building AI agents or large language model (LLM) automation, for example on Azure AI Foundry with Azure OpenAI, or integrating agents such as Microsoft Security Copilot into security workflows
• A clear view of the risks of AI agents in an operational setting, including prompt injection, over-privileged agent identities and unreliable output
• Experience with vulnerability and exposure management tools such as Tenable, Qualys, Rapid7, Wiz or XM Cyber
• Familiarity with frameworks such as MITRE ATT&CK and the Gartner CTEM model
• Scripting or programming skills (Python, Kusto Query Language (KQL), Search Processing Language (SPL) or similar) and experience with infrastructure as code
• Strong client-facing skills: you can run a workshop, write a design and explain it to an executive

• Full Australian working rights

Why join Skillfield?

• Be part of a team serious about doing work that matters
• Join a culture that values clarity, autonomy and shared success
• Enjoy flexibility, strong support and performance-based recognition

Ready to make a measurable impact?

Apply now and help us deliver impact that matters.

Skillfield is committed to an inclusive workplace. If you need any adjustments during the recruitment process, let us know and we'll work with you.