Detection Engineer

About the Role

We are looking for candidates with strong hands-on experience in building detections, threat hunting, detection engineering, and alert handling. Candidates from purely operational SOC monitoring or support backgrounds may not be the best fit unless they have actively developed and maintained detection content.

Key Responsibilities

• Research attacker techniques and develop new detection use cases.
• Design, build, test, and deploy detection rules across SIEM, EDR, SOAR, and Security Data Lake platforms.
• Develop detection logic using SQL, KQL, Python, and detection-as-code practices.
• Investigate alerts, improve detection quality, and reduce false positives.
• Work closely with incident responders to validate detection effectiveness.
• Support threat hunting and detection tuning activities.
• Analyze security telemetry from cloud, endpoint, identity, network, SaaS, Kubernetes, and AWS environments.
• Produce clear documentation for detections, response playbooks, and investigation guidance.
• Collaborate with cross-functional teams to improve security monitoring coverage and response capabilities.

Requirements

• Degree in Computer Science, Cyber Security, Software Engineering, or a related discipline.
• Hands-on experience in Detection Engineering, Security Engineering, SOC, or Incident Response.
• Experience building and tuning detection rules in SIEM, EDR, or SOAR platforms.
• Strong knowledge of security investigations and threat detection.
• Experience with at least one cloud platform (AWS, Azure, or GCP).
• Proficiency in Python and SQL (KQL is an advantage).
• Experience working with large security datasets.
• Knowledge of MITRE ATT&CK, threat hunting, and detection lifecycle.
• Familiarity with AI, Kubernetes, Amazon EKS, IoT, or autonomous systems is an added advantage.