Role Overview
We are looking for a Senior Detection & Alerting Engineer to build, enhance, and mature our enterprise threat detection capabilities. The role will focus on reliable, measurable, high-quality detections and progressively advance toward behavioral, risk-based, automated, and AI-assisted detection.
Key Responsibilities
Detection Engineering: Design, develop, test, deploy, and maintain detection rules and use cases across endpoint, network, identity, cloud, SaaS, and application environments.
Threat Detection & Coverage: Map detections to MITRE ATT&CK, identify coverage gaps, and turn threat intelligence, incident findings, and adversary TTPs into actionable detections.
SIEM & Log Engineering: Manage detection content and correlation rules; onboard and validate log sources; troubleshoot ingestion, parsing, normalization, and data-quality issues.
Alert Quality & Validation: Test and review detection logic, reduce false positives, improve alert fidelity, and tune or retire ineffective rules.
Performance & Automation: Measure detection effectiveness and MTTD, improve alert prioritization and contextual enrichment, and automate repetitive detection and investigation workflows.
Advanced Detection: Develop behavioral and risk-based detections, support UEBA, and contribute to AI-assisted alert triage, detection engineering, and predictive risk analytics.
Required Skills & Experience
5–8 years of cybersecurity experience, with hands-on work in detection engineering, SIEM engineering, threat hunting, or security operations.
Practical experience with at least one SIEM platform: Microsoft Sentinel, Splunk, IBM QRadar, or Elastic Security.
Proficiency in at least one SIEM query language, such as KQL or SPL, and experience developing and tuning detection rules.
Good understanding of MITRE ATT&CK, Windows security, Active Directory/identity, endpoint, network, and cloud security.
Experience with log onboarding, detection validation, event correlation, false-positive reduction, and detection-gap analysis.
Strong analytical and troubleshooting skills, with the ability to collaborate across SOC, Incident Response, Threat Intelligence, Cloud, and Infrastructure teams.
Preferred Skills
Detection-as-Code, Sigma, EDR/XDR, UEBA, SOAR, threat intelligence integration, or adversary simulation.
Exposure to AI/ML-driven security analytics, automated detection testing, or risk-based alerting.
Qualifications
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.