Detection Engineer

About the role

Responsibilities

• Lead SIEM, EDR/XDR, and SOAR detection content development and manage detection use case lifecycle, validation, and quality assurance.
• Coordinate threat hunting and detection gap assessments; improve enterprise detection coverage and maturity.
• Drive detection automation and continuous optimization; align capabilities with emerging threats and attack techniques.
• Monitor detection performance and alert quality, address gaps, and support complex incident investigations.
• Track detection coverage, tuning activities, and operational KPIs.

Qualifications and experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 7–10 years of cybersecurity experience, focused on detection engineering, SIEM, or threat detection.

Required skills

• Advanced SIEM detection rule and correlation search development; strong SPL, KQL, or equivalent query language skills.
• EDR/XDR detection engineering and analytics; MITRE ATT&CK mapping and detection coverage assessment.
• SOAR playbook integration and security automation; Python, PowerShell, or Bash scripting.
• Threat intelligence and IOC integration; detection testing, validation, and performance tuning.
• Log analysis, parsing requirements, telemetry validation, threat hunting, and attack technique analysis.
• Cloud, network, endpoint, and OT/IoT detection concepts; detection metrics, dashboards, and reporting.
• Root cause analysis, troubleshooting, technical documentation, and team mentoring.