Our client is seeking an experienced detection engineering professional to join a high-performing Security Operations team responsible for advancing security monitoring, detection engineering, and cyber defense capabilities within a major financial institution. This role focuses on building, tuning, and maintaining effective detections across cloud and on-premises environments to proactively identify, investigate, and respond to threats. The successful candidate will bring hands-on experience with security telemetry, analytics, automation, and detection-as-code practices, and will be expected to execute with limited guidance while collaborating closely with analysts, incident responders, threat intelligence, and technology partners.
? Critical Requirements
- Minimum 3 years of direct cybersecurity, detection engineering, SOC engineering, or security analytics experience
Role Objectives
- Design, develop, tune, and maintain threat detection logic across cloud and on-premises environments to improve visibility, alert quality, and response effectiveness
- Build and maintain efficient data ingestion and log onboarding pipelines for security-relevant telemetry from infrastructure, applications, endpoints, identity platforms, and cloud services
- Partner with threat intelligence teams to translate emerging threats, attacker techniques, and indicators of compromise into actionable detection strategies
- Collaborate with security analysts, incident responders, SOC engineers, and cross-functional technology teams to investigate detections, validate coverage, and reduce time to detect and respond
- Develop and fine-tune detection rules, signatures, correlation logic, behavioral analytics, and alerting thresholds to improve fidelity and reduce false positives
- Map detections and coverage to relevant frameworks including MITRE ATT&CK to support measurable improvements in monitoring and response capabilities
- Use automation, scripting, and detection-as-code practices to improve consistency, scalability, testing, deployment, and lifecycle management of detection content
- Evaluate security monitoring technologies, data sources, and analytics capabilities to identify opportunities to enhance detection coverage and operational efficiency
- Ensure detection engineering practices align with applicable compliance, regulatory, and internal control requirements
- Create and maintain clear documentation for detection logic, data sources, tuning decisions, operational procedures, and response playbooks
- Continuously assess the effectiveness of cybersecurity monitoring controls and recommend improvements to strengthen cyber resilience
Qualifications & Skills
Cloud & On-Prem Log Analysis
SIEM / UEBA / EDR / SOAR
Detection-as-Code Pipelines
MITRE ATT&CK Framework
Query Languages & Data Analysis
Threat Intelligence Translation
Automation & Scripting
Windows & Linux OS
Behavioral Analytics
Security Telemetry & Correlation
Data Lake & Ingestion Pipelines
Response Playbook Development
? Additional Experience a Plus
- Incident response
- Threat intelligence operations
- Vulnerability management
- Security engineering
- Cloud security