SOC Detection Engineer

The Role

We are looking for experienced SOC Detection Engineers to design, develop and continuously improve threat-led detection capabilities across an enterprise security environment.

You will translate cyber threat intelligence, threat modelling outputs, threat hunting findings, red/purple team exercises and incident learnings into high-fidelity detection logic that identifies sophisticated attacker behaviour while minimising false positives.

This is a specialist detection engineering position focused on attacker behaviour analytics, detection coverage, security telemetry, detection automation and continuous improvement.

The role is not primarily focused on day-to-day SIEM administration or platform support.

Key Responsibilities

• Design, develop and maintain threat-led detection rules aligned with MITRE ATT&CK and organisational threat models.
• Translate threat intelligence, threat hunting insights, red/purple team findings and incident investigations into effective detection use cases.
• Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.
• Continuously tune and optimise detection logic to improve detection accuracy, reduce false positives and strengthen SOC effectiveness.
• Assess detection coverage, identify telemetry gaps and define requirements for improved security monitoring.
• Validate detection capabilities through attack simulation, purple teaming and adversary emulation.
• Maintain detection documentation, version control and engineering standards, including Detection-as-Code practices.
• Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams.
• Develop automation for detection testing, validation, reporting and lifecycle management.
• Identify opportunities to automate repetitive SOC analyst activities.
• Contribute to AI-enabled detection hypothesis generation and automated rule creation pipelines.

Essential Skills and Experience

• Strong hands-on experience in SOC Detection Engineering, including detection rule development, validation, tuning and lifecycle management.
• Excellent knowledge of MITRE ATT&CK, attacker TTPs, behavioural analytics and threat-led detection methodologies.
• Experience translating cyber threat intelligence, threat modelling and threat hunting findings into operational detection logic.
• Practical experience developing detection content using KQL, SPL, Sigma, Python and PowerShell.
• Strong understanding of security telemetry across endpoint, identity, cloud, network, authentication and application environments.
• Experience with detection correlation, threat analysis and Detection-as-Code methodologies.
• Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness.
• Knowledge of Active Directory, IAM, cloud security, endpoint security, network security and email security.
• Ability to identify monitoring gaps, improve detection coverage and reduce false positives.
• Experience collaborating with SOC, Threat Intelligence, Incident Response and offensive security teams.

Desirable Experience

• Experience developing enterprise-scale detections using Microsoft Sentinel, Splunk, Elastic or Google Chronicle.
• Experience creating detections using telemetry from Microsoft Defender, CrowdStrike, SentinelOne or equivalent EDR/XDR platforms.
• Hands-on involvement in purple teaming, adversary emulation and attack simulation.
• Experience creating behavioural detections for sophisticated threat actors.
• Experience automating detection testing and validation processes.
• Experience supporting AI-enabled detection engineering or automated rule creation.
• Relevant degree in Cybersecurity, Computer Science, Digital Forensics, Information Security or equivalent experience.