Cyber Hunt and Threat Emulation

Job Details

Job Title: Cyber Hunt and Threat Emulation

Employment Type: Ongoing

Classification: Parliamentary Executive Level 1

Closing Date: 11:30pm AEST, 24 August 2026

Contact: Brendon McKinley, (02) 6277 2828, brendon.mckinley@aph.gov.au

The Opportunity

The Department of Parliamentary Services (DPS) supports the operation of the Australian Parliament by providing secure, reliable and effective ICT services across Australian Parliament House (APH). Within the Information Services Division, the Cyber Security Branch protects DPS and APH systems, information and users from cyber security threats through governance, assurance, engineering, monitoring, detection and response activities.

The role sits within the Cyber Security Operations Section and leads the department’s Cyber Hunt and Threat Emulation (CHATE) capability. CHATE provides specialised offensive security, cyber hunt, penetration testing, red team and threat emulation services that help DPS identify and remediate security weaknesses before they can be exploited.

As the Assistant Director Cyber Hunt and Threat Emulation, you will manage the day-to-day operation of the CHATE function, including work planning, prioritisation, staff guidance, quality assurance and delivery of agreed cyber security outcomes. The role scopes, plans, manages and undertakes cyber hunt, penetration testing, red team, threat emulation and other technical security assurance activities across networks, applications, cloud services, end-user environments and enterprise platforms.

The role works closely with CSOC analysts, cyber engineering, detection engineering, cyber threat intelligence, project delivery teams, system owners, service providers and senior stakeholders. It supports the security accreditation process by identifying suitable candidates for penetration testing and related assurance activities, providing expert technical advice, and recommending practical remediation, mitigation or compensating controls.

This is a unique opportunity to lead and shape a hands-on offensive security and hunt capability in a nationally significant parliamentary environment. The successful candidate will help mature CHATE services, uplift frameworks and methodologies, and directly improve DPS’s ability to find, understand and reduce cyber risk across complex and sensitive technology environments.

Who we are looking for

We are looking for an experienced, technically credible and practical cyber security professional who can lead offensive security and hunt activities, manage sensitive engagements, and provide clear advice on vulnerabilities, threat actor tradecraft and security control weaknesses. The ideal candidate will be curious, disciplined and collaborative, with the judgement to balance technical depth, operational risk, stakeholder confidence and business impact.

The successful candidate will demonstrate:

• experience leading or managing a technical cyber security function, including work planning, prioritisation, staff guidance, quality assurance and delivery of outcomes in a complex operating environment;
• demonstrated experience planning, scoping and conducting penetration testing, cyber hunt, red team, threat emulation or similar technical security assurance activities across enterprise technology environments;
• strong technical knowledge of common vulnerability classes, exploitation methods, operating systems, networks, web applications, cloud services, security controls and the tools and methodologies used to assess them;
• the ability to analyse threat intelligence, vulnerability information, technical findings and operational context to assess exposure, prioritise activity and provide practical remediation or mitigation advice;
• well-developed written and verbal communication skills, including the ability to prepare clear technical reports, rules of engagement, permission documentation, briefings and recommendations for technical and non-technical audiences;
• a continuous improvement mindset, with the ability to develop frameworks, methodologies, procedures, tooling and reporting practices that mature CHATE services and support broader Cyber Security Branch objectives.
  
  

A minimum of five years’ relevant cyber security experience, or demonstrated equivalent experience, is required. Relevant industry certifications or equivalent experience is desirable. Tertiary qualifications in information technology, computer science, cyber security or a related discipline are also desirable. Experience with Microsoft Azure, Microsoft 365, hybrid cloud environments, scripting, red team activities, physical security assessment, social engineering, MITRE ATT&CK, the cyber kill chain or the diamond model would be highly regarded.

Job Specific Requirements: 

    
•  The successful applicant will be required to obtain and maintain a Negative Vetting 1 (Confidential/Highly Protected/Secret) security clearance.

At DPS, we are committed to building a diverse and inclusive workplace that ensures all our people can contribute to our shared purpose. We encourage applications from Aboriginal and Torres Strait Islander people, people with disability, people with caring responsibilities, people who identify as LGBTQIA+, people from cultural and linguistically diverse backgrounds, people who identify as neurodivergent, and mature aged people.

Duty Statement

Classification: Parliamentary Executive Level 1 

Branch: Cyber Security 

Section: Cyber Security Operations 

Immediate supervisor: Director, Cyber Security Operations

Duty Statement

Under limited/general direction undertake duties in accordance with the agreed standards for the specified classification. The duties will include, but are not limited to, the following:

1.    Lead and manage the day-to-day operations of the Cyber Hunt and Threat Emulation function, including work planning, prioritisation, quality assurance, staff guidance and delivery of agreed cyber security outcomes.

2.    Plan, scope and deliver cyber hunt, penetration testing, red team, threat emulation and other technical security assurance activities across networks, applications, cloud services, end-user environments and enterprise platforms.

3.    Provide expert technical advice to stakeholders on cyber risk, vulnerabilities, threat actor tactics, security control weaknesses and practical remediation or mitigation options.

4.    Analyse threat intelligence, vulnerability reporting, incident information and technical telemetry to identify exposure, prioritise activity and support informed cyber security decision-making.

5.    Prepare clear, evidence-based technical reports, briefs and recommendations that communicate findings, risks, business impact and remediation priorities to technical and non-technical audiences.

6.    Contribute to the uplift of Cyber Hunt and Threat Emulation services by developing frameworks, methodologies, procedures, tooling, reporting practices and capability improvement initiatives aligned to departmental cyber security objectives.

Selection Criteria

1.    Demonstrated ability to lead and manage a technical cyber security function, including planning work, setting priorities, supporting staff, assuring quality and delivering outcomes in a complex operating environment.

2.    Demonstrated experience planning, scoping and conducting penetration testing, cyber hunt, red team, threat emulation or similar technical security assurance activities across enterprise technology environments.

3.    Strong technical knowledge of common vulnerability classes, exploitation methods, operating systems, networks, web applications, cloud services, security controls and the tools and methodologies used to assess them.

4.    Ability to analyse threat intelligence, vulnerability information, technical findings and operational context to assess risk, prioritise activity and provide practical remediation or mitigation advice.

5.    Well-developed written and verbal communication skills, including the ability to prepare clear technical reports and explain complex cyber security risks, findings and recommendations to technical and non-technical stakeholders.

6.    Eligible qualifications and/or other technical requirements: minimum five years’ relevant experience in cyber security or a related discipline; relevant certifications such as GPEN, GWAPT, OSCP, OSWE, OSEP or equivalent are desirable; tertiary qualifications in information technology, computer science, cyber security or a related discipline are desirable; experience in Microsoft Azure, Microsoft 365, hybrid cloud environments, scripting, red team activities, physical security assessment or social engineering is desirable.

Employees of DPS are required to be able, and to be seen to be able, to provide professional advice and services to all Senators and Members without favour or prejudice.

How to apply

Please upload a one page pitch describing how your skills and experience would contribute to the role and work of the department. 

Your pitch is an opportunity to tell us why you want to work at DPS, why you are interested in the role and what you can offer in the role. Frame your pitch around the role description and relevant ILS Profile. Make sure to use relevant examples and accomplishments that demonstrate your ability to perform the role. 

For additional guidance when crafting you application, please refer to the DPS Recruitment - Candidate Information Pack, which provides helpful tips on how to structure your pitch and highlight your most relevant skills and experience effectively.

Our purpose and values

We proudly provide innovative, unified, and client-focused services to the Australian Parliament and parliamentarians. We are a values driven department, placing our values at the heart of everything we do; from our service offerings and decision making to our interactions with stakeholders and each other.  

Our people are employed in a broad and unique range of professional, customer service and trade-based roles, all joined by a shared purpose: to make an enduring contribution to Australia’s parliamentary democracy. We have an inclusive workplace that reflects the diversity of the community we serve. While we come from all walks of life, we share a commitment to care for and protect our iconic workplace. 

Every year, almost one million people visit Australian Parliament House to experience the parliamentary process, the building’s architecture, nationally significant art collections, events, tours, and food and dining experiences – all made possible by our people, who are active participants in an environment where no two days are the same.

What we can offer

Join our community based on innovative, unified, and client-focused services, where your skills and development will be nurtured. You will also enjoy:  

• flexible working arrangements can be negotiated in accordance with our Enterprise Agreement and the operational needs of the roles
• ongoing opportunities to learn and develop new capabilities 
• a competitive remuneration package
• free on-site parking
• free gym membership and access to recreational facilities available a APH
• childcare (pending availability), banking services, post office, value-for-money dining options and more available at APH.

Salary

An attractive salary, which could be negotiated with the successful candidate, is on offer.

Conditions of Employment

Employment opportunities at the department are subject to a range of conditions prescribed in the Parliamentary Service Act 1999 which include:

• Australian citizenship: Section 22 of the Parliamentary Service Act 1999 requires that employees of the Parliamentary Service are generally required to be Australian citizens. However, if you are not an Australian citizen you may be considered for engagement on the condition that you are able to gain Australian Citizenship within a specified time. Failure to obtain citizenship within the timeframe could lead to termination of employment.
  
  
• Loss and resumption of Australian citizenship: Under historical provisions of the Australian Citizenship Act 1948 (section 17), some Australian citizens automatically lost their citizenship if they voluntarily acquired the citizenship of another country between 26 January 1949 and 3 April 2002. This loss occurred by operation of law and may not have been known to the individual at the time. Although these provisions were repealed in 2002 to allow dual citizenship, the repeal did not restore citizenship that was previously lost. Individuals who believe they may be affected are recommended to seek advice about resuming their Australian citizenship. Further information, is available on the Department of Home Affairs website.
• Applicants who progress to the offer stage with our department who have been affected by the loss of citizenship as outlined above will be required to demonstrate within a reasonable time that they have resumed, or are actively undertaking the process to resume, Australian citizenship.
  
  
• Security clearance and character clearance: the preferred applicant will be required to obtain and maintain a security clearance at the level specified, as well as complete and be deemed suitable through a Nationally Coordinated Criminal History Check.
  
  
• Health assessment: a pre-employment health assessment will be required where there are physical or medical requirements for the role.
  
  
• External Work Approval: Employees must seek approval for any paid employment outside the department and declare voluntary activities that could impact their role.