Detection Engineer
Europe | Full-time
Responsibilities
- Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage
- Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners
- Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions
- Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs
- Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use
- Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps
- Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope
- Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path
- Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager
Requirements
- Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action
- Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools
- Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques
- Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows
- Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work
- Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover
- Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes
- Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps
- Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work
- Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required
- Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence
Will Be a Plus
- Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices
- Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments
We offer
- 20 paid vacation days per year
- 10 paid sick leave days per year
- Public holidays as per the company’s approved Public holiday list
- Medical budget
- Opportunity to work remotely
- Professional education budget
- Language learning budget
- Wellness budget (gym membership, sports gear and related expenses)