SOC Detection Engineer

New Exciting Contract for the role of SOC Detection Engineer

Location: Leamington Spa / Manchester Centre / Warrington (Hybrid- 2-3 days Onsite)

Contract Duration: 6 Months

IR35 Status: Inside IR35

The Role

The Senior Detection Engineer is responsible for designing, developing and continuously improving threat-led detection capabilities that identify sophisticated attacker behaviors across the enterprise.

The role translates cyber threat intelligence, threat modelling outputs, red team findings, threat hunting insights and incident learnings into high-fidelity detection logic capable of identifying malicious activity while minimising false positives.

The individual owns the end-to-end lifecycle of detection content, from threat analysis and hypothesis development through to detection design, validation, tuning, optimisation and retirement.

This is a specialist detection engineering role focused on attacker behavior analytics, detection coverage, telemetry strategy and continuous improvement of detection effectiveness. The role is not primarily responsible for day-to-day SIEM administration, platform support or security tooling operations.

Your Profile

Essential skills/experience:

1. Detection Engineering: Threat-led detection development, behavioral analytics, ATT&CK mapping, detection tuning, validation and lifecycle management.

2. Threat Analysis & Hunting: Threat intelligence, threat modelling, adversary TTP analysis, attack path analysis and threat hunting methodologies.

3. Security Telemetry & Monitoring: Experience working with endpoint, identity, cloud, network, authentication and security telemetry across enterprise environments.

4. Detection Analytics & Automation: Development of detection logic using KQL, SPL, Sigma, Python and PowerShell, including data correlation and Detection-as-Code practices.

5. Security Operations & Incident Response: Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness measurement.

6. Security Domains: Knowledge of Identity & Access Management, Active Directory, Cloud Security, Endpoint Security, Network Security and Email Security.