Senior Detection & Threat Engineer

You will own and evolve the company's threat detection and threat-hunting capability. This role defines what "good" looks like for detection and increasingly engineers it directly as capability shifts into Cyber Security.

This is not an alert-triage role. You are here to understand attacker behaviour, convert it into high-fidelity detection logic, and raise the security baseline for the entire organisation.

You will partner closely with Security Operations, GRC and Engineering-setting standards, direction, and expectations-while progressively taking ownership of the most complex and high-value detection and threat engineering work.

• Engineering high-fidelity threat detections across endpoint, identity, cloud, and SaaS
• Defining detection standards, principles, and quality thresholds for Security Operations
• Conducting proactive threat hunting based on attacker behaviour, not vendor alerts
• Translating threat intelligence and incident learnings into durable, reusable detections
• Mapping detections to MITRE ATT & C K and real-world attack paths
• Reducing alert fatigue through logic refinement, correlation, and contextual enrichment
• Advising and supporting during high-severity security incidents; contribute to runbooks and escalation playbooks
• Driving the transition of advanced detection capability into Cyber Security ownership

• Proven experience in detection engineering, threat hunting, or advanced SOC roles
• Deep understanding of modern attacker tradecraft and intrusion techniques across the attack lifecycle
• Hands-on experience buidling detection logic in modern SIEM platforms (e.g Sentinel)
• Proficienty with scripting and programmaining (e.g. Python, KQL) to build detection pipelines and automation
• Willingness to challenge bad detections, weak assumptions, and vanity metrics
• Pragmatic mindset: precision and impact beat coverage theatre
• Experience operating beyond traditional SOC or MSSP models
• Hands on cloud detection experience (identity, control plane, SaaS)
• Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT & C K for Cloud.