About Metro Trains Sydney (MTS)
MTS are the proud operators and maintainers of the M1 Northwest and Bankstown Line with the new City section now operational. We run a fully automated passenger railway – an Australian first. We connect our customers to opportunities that matter to them while delivering the next generation of rail travel to Sydney. With global expertise, we manage 51.5km of track and 21 stations, with a planned expansion into southwest Sydney.
About the role
Reporting to the Cyber Security Manager, you will lead the investigation and response to cyber security incidents across MTS IT and OT environments. You will coordinate assurance activities, vulnerability remediation, security monitoring and resilience exercises while partnering with technical, operational and business stakeholders.
As a trusted subject matter expert, you will translate complex cyber risks into practical action and help ensure our critical rail operations remain secure, resilient and aligned with regulatory and organisational requirements.
Key responsibilities
- Lead technical investigation and triage of cyber security incidents affecting IT and OT environments.
- Coordinate containment, eradication, recovery and post incident review activities.
- Strengthen security monitoring and detection capability in partnership with SOC, MDR and cyber operations providers.
- Plan and facilitate cyber security tabletop exercises, desktop exercises and incident simulations.
- Coordinate penetration testing, vulnerability assessments and risk based remediation programs.
- Support the implementation and validation of cyber security technologies across IT and OT environments.
- Develop cyber security playbooks, procedures, metrics, dashboards and management reporting.
About you
You are a collaborative cyber security professional who can lead confidently during incidents, communicate clearly with diverse stakeholders and turn technical findings into practical risk-based actions.
You will bring:
- A tertiary qualification in Cyber Security or a related discipline, or equivalent professional experience.
- Four to six years’ experience in Cyber security operations or cyber resilience, ideally within critical infrastructure, transport, utilities, energy or industrial environments.
- Demonstrated experience coordinating cyber incident response, including containment, recovery, evidence preservation and post-incident reviews.
- Experience working with SOC, MSSP, MDR, DFIR or external cyber security providers.
- Strong capability across SIEM, EDR/XDR, vulnerability management, penetration testing, firewalls, network segmentation and cloud security.
- Experience securing Microsoft Azure, Microsoft 365 or hybrid cloud environments.
- Strong written and verbal communication skills, including executive reporting and stakeholder communications during security events.
- Knowledge of OT, Industrial Control Systems or critical infrastructure cyber risk will be highly regarded, as will Splunk experience.
What’s on Offer
We are offering a permanent opportunity with flexible working options and access to a wide range of benefits:
- Fitness Passport discounts and access to gyms across NSW
- Maxxia Vehicle Leasing options
- Employee Recognition Awards
- EAP services including confidential advice
The future of train travel, today. That’s what we intend to deliver. And it all starts with our people. Positive and upbeat with an ‘anything-is-possible’ approach, the MTS team is rewriting expectations.
So, if you are energised and enthused by working in a challenging, future focused, vibrant, can-do environment, then let’s talk!
Apply Today!
MTS is an equal employment opportunity employer. We are committed to an inclusive workforce and welcome applications of candidates from culturally diverse backgrounds, people with disabilities, and people of Aboriginal and Torres Strait Islander descent.