Senior Detection Engineer - Banking (m/f/d)

Role overview

Leadership and intelligence-driven detection

• Establish the detection engineering function, operating model, roadmap, standards, development processes, governance controls, and content quality frameworks.
• Lead and mentor detection engineers and security analysts; present strategies, risk-based recommendations, and coverage assessments to senior stakeholders.
• Translate threat intelligence into prioritized detection requirements and operational capabilities for threat actors, attack campaigns, insider threats, and emerging risks.
• Collaborate with Threat Intelligence, Threat Hunting, Red Team, and Incident Response teams.

Detection development and validation

• Develop advanced detections using Microsoft Sentinel, IBM QRadar, KQL, and AQL, including behavioral, anomaly-based, and correlation detections.
• Build Detection-as-Code supported by version control and CI/CD; integrate detection content with automated response and SOAR capabilities.
• Map coverage to MITRE ATT&CK, MITRE D3FEND, Cyber Kill Chain, Diamond Model, and Pyramid of Pain; identify and prioritize detection gaps.
• Validate detections using purple teaming, adversary emulation, and attack simulation, and continuously improve coverage, fidelity, and response effectiveness.

Governance and performance

• Define and report detection coverage, alert fidelity, false-positive rates, and mean time to detect (MTTD).
• Maintain audit-ready documentation and evidence, support regulatory and audit requirements, and ensure critical log sources serve detection objectives.

Required experience and qualifications

• At least 8 years of cybersecurity experience, including at least 4 years focused on Detection Engineering or Threat Detection.
• Proven experience building or leading enterprise detection engineering functions.
• Expertise in Microsoft Sentinel, IBM QRadar, threat detection engineering, security monitoring, and threat intelligence integration.
• Strong expertise in KQL, AQL, Detection-as-Code, Git repositories, CI/CD pipelines, and Python and PowerShell scripting.
• Understanding of MITRE ATT&CK, MITRE D3FEND, NIST CSF, Cyber Kill Chain, Pyramid of Pain, and Diamond Model.
• Experience developing detections across Windows, Linux, Azure, Microsoft 365, identity services, and network security platforms.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline; strong communication, leadership, and problem-solving skills.

Preferred experience and certifications

• Banking or financial services experience is preferred.
• Experience with Sigma, YARA, MISP, OpenCTI, Recorded Future, Microsoft Defender XDR, advanced EDR, threat hunting, or cyber threat intelligence is preferred.
• Exposure to Red Teaming, Purple Teaming, and adversary emulation and experience in highly regulated enterprises are preferred.
• GIAC GCDA, GCIA, GCTI, GCIH, or GREM; Microsoft SC-200; IBM QRadar certifications; CISSP; and OSCP are preferred or desirable.

About Halian