Threat Detection Engineer

Who you are

• Strong knowledge with one of the following: Splunk, Scanner, Sentinel, SecOps
• Strong understanding of modern attack and defence techniques which apply to Cloud (AWS, GCP), SaaS (such as Google Workspace and Okta) and desktop (Windows and macOS) environments
• Passion for passing on knowledge to fellow colleagues
• Hands-on attitude and the ability to drive solutions to completion
• Strong experience in security automation, from writing scripts to creating end-to-end automated workflows. Familiarity with SOAR platforms and automating threat detection and response tasks
• Excellent spoken and written communication skills
• Experience with writing automation and scripts; bonus points if you have a repository to show-case your work

What the job involves

• The Tide Security Engineering team is made up of three core areas: Product Security, Identity, Threat Detection & Response
• Product Security consists of application and cloud security experts. Their mission is to protect the products we build, covering everything from secure design reviews to threat modelling and penetration testing, ensuring security is embedded from the ground up
• Threat Detection & Response (this role!) focuses on protecting the company by building a robust detection and automation platform. We’re proactive in our defence, constantly hacking ourselves to improve our security posture and staying ahead of emerging threats. Our goal is to make Tide resilient against the ever-evolving threat landscape
• Identity is responsible for managing Tide's staff identity platform, ensuring that access to systems and infrastructure is secure, seamless, and aligned with modern security practices. The team uses strategies like zero trust, multi-factor authentication, and granular role-based access controls to safeguard our internal operations
• While each area has its own focus, collaboration is key - it's why we share the same Slack channel and hold our standups together as one cohesive team, ensuring alignment and seamless communication across all security functions
• Supporting the development and implementation of a strategic vision for threat detection, driving the overall direction and priorities for a team of highly talented engineers
• Getting hands-on with SIEM systems, including creating custom log-parsers for in-house applications, configuring alert rules, performing log analysis and tuning detections to reduce false positives
• Creating security automations and services to automate mundane tasks; from data enrichment to automatically removing phishing emails from employee mailboxes. We want you to run with the “anything is possible” mantra
• Continuously hunting for sophisticated threats across our infrastructure, leveraging threat intelligence and innovative detection techniques to stay ahead of attackers. You'll monitor and respond to threats across AWS, GCP, internal applications, and employee endpoints (Windows, macOS)
• Collaborating with cross-functional teams to develop and implement; business-specific threat detection rules
• Responsible for ensuring the quality of detections, and uptime of our detection ecosystem through mature test driven development paired with proactive health monitoring capabilities
• Identifying opportunities to build or enhance internal tools that streamline threat detection processes, improve data visibility, and increase response efficiency
• Leading complex incident investigations, coordinating efforts across the security, IT, and engineering teams to ensure rapid and effective containment, remediation, and recovery
• Support as part of the wider security incident response on-call rota

Benefits

• Flexible working:A flexible working policy that allows most teams to work from home when they need to
• Family-friendly leave: We go above and beyond the statutory requirement for maternity and paternity leave
• Paid volunteering leave: You’re encouraged to take three days a year as paid volunteering leave for your chosen charity or organisation
• Holiday leave: 25 days a year of paid holiday leave, plus bank holidays
• Sabbatical leave: Take a well-deserved break and come back refreshed
• Extra unpaid leave: Extra time off is available beyond your annual leave allocation
• We keep the team fed: Breakfast, snacks and hot drinks are provided daily, along with regular morning teas and catered events
• Personal development: Personal development budget is available for each Tidean to pursue additional training related to their role
• Private health cover: Private healthcare from Vitality, that includes the ability to earn discounts and rewards for having a healthy lifestyle
• Mental wellbeing : 24/7 Employee assistance, unlimited cognitive behavioural therapy, subsidised mindfulness and relaxation app