Senior Detection Engineer - Banking (m/f/d)

Role overview

Leadership and intelligence-driven detection

• Establish the detection engineering function, operating model, and capability roadmap.
• Set content standards, development processes, governance controls, and quality frameworks.
• Lead and mentor detection engineers and security analysts; present strategies and coverage assessments to senior stakeholders.
• Translate threat intelligence into prioritized requirements and operational detections for threat actors, campaigns, insider threats, and emerging risks.
• Coordinate with Threat Intelligence, Threat Hunting, Red Team, and Incident Response teams.

Detection development and validation

• Develop and optimize detections with Microsoft Sentinel, IBM QRadar, KQL, and AQL.
• Build behavior-based, anomaly-based, and correlation detections; implement Detection-as-Code with version control and CI/CD.
• Integrate detections with automated response and SOAR workflows.
• Map coverage to MITRE ATT&CK, MITRE D3FEND, Cyber Kill Chain, Diamond Model, and Pyramid of Pain; prioritize gaps.
• Validate detections with purple teaming, adversary emulation, and attack simulations.

Governance and performance

• Define and report detection coverage, alert fidelity, false-positive rates, and mean time to detect.
• Maintain audit-ready documentation and evidence; support regulatory, compliance, and audit requirements.
• Ensure critical log sources support detection objectives and continuously improve coverage and response effectiveness.

Required experience and qualifications

• 8+ years of cybersecurity experience, including 4+ years in Detection Engineering or Threat Detection.
• Experience building or leading enterprise detection engineering functions.
• Expertise in Microsoft Sentinel, IBM QRadar, threat detection, security monitoring, and threat intelligence integration.
• Strong KQL, AQL, Detection-as-Code, Git, and CI/CD skills.
• Knowledge of MITRE ATT&CK, MITRE D3FEND, NIST CSF, Cyber Kill Chain, Pyramid of Pain, and Diamond Model.
• Detection development across Windows, Linux, Azure, Microsoft 365, identity services, and network security platforms.
• Strong Python and PowerShell scripting; excellent communication, leadership, and problem-solving skills.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline.

Preferred experience and certifications

• Banking/financial services experience; Sigma, YARA, MISP, OpenCTI, or Recorded Future experience.
• Red Teaming, Purple Teaming, adversary emulation, Microsoft Defender XDR or advanced EDR, threat hunting, or cyber threat intelligence experience.
• Experience in highly regulated enterprise environments.
• Relevant certifications are desirable, including GIAC GCDA, GCIA, GCTI, GCIH, GREM; Microsoft SC-200; IBM QRadar certifications; CISSP; or OSCP.

About Halian