Triskele Labs is one of Australia's leading sovereign cyber security firms, delivering Managed Detection & Response (MDR), Digital Forensics & Incident Response (DFIR), Offensive Security, and Governance, Risk & Compliance (GRC) services to regulated enterprises, government, and the higher education sector. Built over more than a decade, founder-led and independently owned, we partner with clients operating under some of Australia's most demanding regulatory regimes.
Sovereign Australian ownership, deep technical capability, and front-line threat intelligence from one of the most active practices in the country sit at the centre of how we differentiate.
The opportunity
This is a senior technical individual contributor role created to lead in-account technical advisory across our enterprise client base. The role is designed for an experienced practitioner who wants to operate at the front of the Australian cyber security market as a trusted technical voice across our most strategic accounts, without managing a team and without carrying a commercial quota.
You will be the technical advisor embedded across our enterprise accounts, running the technical narrative between Strategic Account Manager touchpoints, interpreting threat data and detection outcomes for our clients, and surfacing the control gaps and forward-looking opportunities that strengthen client security posture and deepen our relationships.
This is not a commercial role. It is not a delivery role. It is a senior technical advisory role focused on the customer relationship, customer success, and the technical narrative that sits underneath both.
What you'll do
Lead in-account technical advisory
- Operate as the trusted technical voice across our enterprise client base, embedded in the security leadership conversations of each account.
- Run monthly and quarterly customer cadences with technical depth, interpreting the data and contextualising it against the broader threat landscape rather than presenting metrics.
- Brief security leadership on threat trends, patterns we are observing across the broader practice, and what they mean for the client's specific environment.
- Be the named technical advisor that the CISO and senior security leaders turn to for input between formal review cycles.
Translate threat intelligence into client value
- Take observations from our DFIR, detection engineering, and threat hunting practices and translate them into client-specific narratives and recommendations.
- Connect threat patterns to control gaps and opportunities across MDR, DFIR, breach attack simulation, threat hunting, identity and access management, data loss prevention, GRC, and offensive security.
- Use front-line case material to drive credibility, technical depth, and forward-looking conversations with our clients.
Surface and shape expansion opportunities
- Identify the control gaps, missing log sources, detection coverage limitations, and security maturity opportunities within each account.
- Surface those observations to Strategic Account Managers as commercial conversations, providing the technical case underneath.
- Partner with Sales Engineers on the technical scoping of expansion engagements within existing accounts.
- Drive net retention and account expansion through technical credibility and trusted advisor positioning.
Own customer health and renewal protection
- Own the technical relationship that protects renewal and retention across each account.
- Identify and act on early signals of customer health risk before they become renewal risk.
- Operate alongside Strategic Account Managers as the technical complement to the commercial relationship.
- Be the reason the client wants to stay, before the renewal conversation begins.
Cross-business integration
- Partner with our MDR, DFIR, Offensive Security, GRC, and Platform Engineering teams to ensure clients benefit from the full breadth of our capability.
- Bring practical insight from the client base back into delivery and platform engineering, contributing to how our services evolve.
- Operate as a senior technical voice within the broader Triskele Labs practice, contributing to thought leadership, content, and sector engagement where appropriate.
Mentor and uplift the Technical Customer Success function
- Mentor more junior Technical Customer Success Managers as the function grows.
- Contribute to the operating model, playbooks, and methodologies of the function.
- Set the standard for what excellent technical customer success looks like at Triskele Labs.
Requirements
Essential experience
- Genuine technical depth across modern security operations — established practitioner background in managed detection and response, security operations, SIEM platforms, detection engineering, threat hunting, or a closely related discipline.
- Multi-domain awareness — strong working knowledge across identity and access management, data loss prevention, incident response, offensive security workflows, and the broader Australian regulatory landscape.
- Pattern recognition — ability to see across multiple client environments and the broader threat landscape, and translate that into client-relevant narrative and recommendations.
- Established credibility in front of senior security leadership — comfortable engaging directly with CISOs, CIOs, audit and risk committees, and senior security and IT leaders. Operates as a peer, not as a reporter.
- Background — likely from a senior practitioner role within an MDR or MSSP, senior detection engineering or threat hunting role, senior cyber consulting (principal level or above), an in-house CISO or senior security leadership role, or a senior technical advisory role within a cyber services firm.
- Customer-facing experience — significant time spent in customer-facing technical advisory work, not purely internal delivery or operations.
Capabilities we value
- Consultative — interprets data, identifies implications, recommends actions. Adds value to a CISO's thinking in every interaction.
- Direct and credible — comfortable holding ground in technical pushback and disagreeing constructively with senior client stakeholders.
- Strong communicator — produces client-grade written content and presents confidently in customer briefings, executive forums, and review cycles.
- Self-directed — operates with significant autonomy, sets their own cadence, and is accountable for customer outcomes.
- Curious and forward-looking — actively reads the threat landscape, stays current with industry developments, and brings forward-looking perspective to customer conversations.
- Genuine customer orientation — measured by customer success, not by tasks completed or reports delivered.
Highly regarded
- Established relationships across the Australian CISO and senior security community.
- Public technical profile through speaking, writing, sector forums, or contribution to industry bodies.
- Credentials such as CISSP, CISM, GIAC certifications, or vendor-specific senior architect certifications.
- Experience operating in regulated environments across financial services, government, critical infrastructure, healthcare, or higher education.
What this role is not
- It is not a commercial role. The Principal TCSM is not measured on revenue or quota.
- It is not a pre-sales role. The Principal TCSM does not run pursuits or own RFP technical responses.
- It is not a delivery role. The Principal TCSM is not measured on personal billable utilisation.
- It is not a management role. The Principal TCSM is a senior individual contributor and is not accountable for managing a team.
- It is not a reporting production role. The Principal TCSM owns the technical advisory conversation; reporting is the vehicle, not the output.
Benefits
What we offer
- A senior individual contributor seat in one of Australia's most established sovereign cyber security firms.
- A meaningful career path within a defined Technical Customer Success function, with progression to Head of as the function scales.
- Significant autonomy and ownership of the technical advisory function across enterprise accounts.
- A platform of real DFIR, detection engineering, and offensive security capability to work from.
- Direct partnership with Strategic Account Managers, Sales Engineers, and the executive team.
- Competitive remuneration including base, performance incentive aligned to customer success outcomes, and benefits, commensurate with senior technical individual contributor experience.
- Flexible working arrangements, with a preference for Melbourne or Sydney-based candidates.
Working at Triskele Labs
Triskele Labs is a sovereign Australian business, founder-led and independently owned. We are direct, we value honest and rigorous thinking, and we expect our senior people to set the tone for the wider team.
We back our people, we hold a high bar, and we are building something genuinely differentiated in the Australian market.
If this opportunity resonates, we would welcome a confidential conversation.
