Detection And Response Analyst

Role Overview

We're looking for an experienced Cyber SOC Detection Engineer to design, build and improve security detections across a large enterprise environment.

This is a hands-on role focused on identifying cyber threats, improving detection accuracy and reducing false positives. You'll work closely with SOC, Incident Response, Threat Intelligence and Security Engineering teams. Working across AI workflows.

Key Responsibilities

• Design, build, test and maintain security detections.
• Manage detections through the full life cycle, from development through tuning and retirement.
• Develop detection rules using KQL, SPL, SQL or similar languages.
• Build detections across endpoint, identity, cloud and network security.
• Map detection coverage against MITRE ATT&CK.
• Identify gaps in security monitoring and improve detection coverage.
• Reduce false positives and improve alert quality.
• Test detections using simulations, log replay and adversary emulation.
• Improve logging, telemetry and data quality.
• Use AI/LLMs and Agentic AI to support SOC detection, triage and response.
• Work closely with SOC analysts, Incident Response and Threat Intelligence teams.
• Maintain clear documentation, runbooks and detection standards.

Essential Skills

• Strong SOC/Detection Engineering experience within a large enterprise environment.
• experience building and tuning production security detections.
• Strong knowledge of attacker tactics and techniques.
• Hands-on experience with KQL, SPL, SQL or equivalent.
• Strong understanding of Windows, identity, cloud, endpoint and network telemetry.
• experience managing the full detection life cycle.
• Understanding of MITRE ATT&CK.
• experience using AI/LLMs or Agentic AI within SOC workflows.
• experience with Git/version control, code reviews and automation.
• Strong communication and stakeholder management skills.

Desirable Skills

• Purple teaming or adversary emulation.
• SOAR integration and automation.
• Python Scripting.
• Data modelling and log normalisation.
• Machine Learning-based anomaly detection.
• Relevant security certifications such as GIAC or cloud security certifications.

Job Title: Detection And Response Analyst

Location: Manchester, UK

Job Type: Contract