Own threat detection and support cyber incident response
Lead threat hunting and develop intelligence-led detections
Shape security automation and support major incident response
Te Whiwhinga mahi | The opportunity
We're looking for three Principal Engineers, Detection and Response to strengthen NZ Transport Agency | Waka Kotahi (NZTA)'s cyber defence capability through advanced threat detection, threat hunting and incident response.
This is a senior technical role that combines hands-on detection engineering, technical leadership and tactical cyber incident response. Working across SIEM, XDR and EDR platforms, you'll improve detection coverage, reduce time to detect threats and help protect critical services from cyber risk.
Key responsibilities include:
Designing, tuning and maintaining detection rules, correlation logic and behavioural analytics
Leading threat hunting activities and translating threat intelligence into actionable detection content
Identifying detection coverage gaps and driving continuous improvement across the detection capability
Developing automation, SOAR playbooks and response workflows to improve security operations
Setting quality standards and validating detection content before deployment
Providing specialist expertise for security tool and platform evaluations
Acting as a tactical responder for significant cyber incidents, supporting containment, eradication and recovery activities
This role participates in a 24/7 on-call roster and plays a critical part in maintaining NZTA's cyber resilience.
You will find out more about the role here Position Description
Ko koe tēnei | About you
You bring strong detection engineering experience, sound judgement in complex situations and the ability to influence technical outcomes without formal people leadership. Comfortable making incident response decisions within delegated authority, you combine practical expertise with a continuous learning mindset. We value practical achievements, transferable skills and potential, so you don't need to meet every requirement.
You'll bring:
Strong experience designing, tuning and managing detection rules, correlation logic or behavioural analytics across SIEM, XDR or EDR platforms
Experience investigating suspicious activity and hunting threats using telemetry and threat intelligence, applying sound judgement when information is incomplete
An evidence-based approach to identifying detection gaps and turning threat insights into practical improvements, with familiarity with MITRE ATT&CK beneficial
Experience using automation or scripting to improve security workflows, with an understanding of testing, assurance and safe deployment. SOAR experience is advantageous
The ability to provide technical guidance, review detection content and strengthen detection and response practices through lessons learned
An understanding of security and privacy obligations, with a willingness to develop knowledge of NZISM and New Zealand public sector requirements
Relevant experience, qualifications, or a combination of both. Certifications such as GCDA, GCIA or GCIH are advantageous
The ability to obtain and maintain a New Zealand national security clearance up to and including SECRET
You will demonstrate knowledge of, or a willingness to gain an understanding of Te Ao Māori and promote tikanga and Te Reo Māori. You will also have knowledge of, or a willingness to gain an appreciation of Te Tiriti o Waitangi (the Treaty of Waitangi) as it applies in the public service.
Mō mātou | About us
At NZTA, we deliver transport networks that connect people, places and New Zealand. Te Aukaha | Digital provides the technology and information services that enable better outcomes for our customers, partners and people.
Within Digital, Security protects NZTA's people, information and technology through resilient operations, assurance, governance and secure-by-design practices.
As part of Security Operations and Resiliency, you'll help strengthen NZTA's 24/7…