Detection Engineer

Job Details

World Wide Technology is hiring for a large financial services client. You will be the detection engineer on call during emergency vulnerability responses and incidents. When the clock is running, you build, test, and deploy new detections so the Security Operations Center can spot active exploitation while patches are still going out.

What you will do

• Build, test, and deploy new detection rules quickly in monitoring tools such as Splunk and CrowdStrike
• Run threat hunts during emergency vulnerability responses and incidents
• Help the SOC see active exploitation while patches are being applied
• Map detections to MITRE ATT&CK

What you bring

• 8+ years in SOC or detection engineering
• Hands on experience building detections and hunts in Splunk (SPL) and CrowdStrike Falcon, including NG SIEM and LogScale queries and custom IOAs
• MITRE ATT&CK mapping
• Availability to be on call and move fast during emergencies

Nice to have

• Sigma and YARA
• Detection as code with Git and CI
• Exploit analysis
• SOAR
• Threat intelligence consumption

Preferred certifications: GCDA, GCIA, GCED, GCTI, CrowdStrike CCFA or CCFH, Splunk certifications

Technology and frameworks

Splunk (SPL), CrowdStrike Falcon (NG SIEM and LogScale queries, custom IOAs), MITRE ATT&CK, Sigma, YARA, detection as code with Git and CI, and SOAR.