Senior Detection Engineer - Banking

About the role

Halian Group is recruiting a Senior Detection Engineer for a banking client in Abu Dhabi, United Arab Emirates. The role leads the design, development and maturity of enterprise threat detection capabilities, establishing a threat-informed detection engineering program that matches organisational risks, intelligence needs and regulatory obligations. It combines strategic leadership with hands-on technical work.

Key responsibilities

• Establish a mature detection engineering function, operating model and roadmap, and define standards, governance and quality frameworks for detection content.
• Lead and mentor detection engineers and security analysts, and present detection strategies and coverage assessments to senior stakeholders.
• Turn threat intelligence into prioritised detection requirements, working with Threat Intelligence, Threat Hunting, Red Team and Incident Response teams.
• Design, develop and optimise detections in Microsoft Sentinel and IBM QRadar using KQL and AQL, including behaviour-based, anomaly-based and correlation detections.
• Develop Detection-as-Code with version control and CI/CD pipelines, and integrate detections with automated response and SOAR workflows.
• Map coverage against MITRE ATT&CK, MITRE D3FEND, Cyber Kill Chain, Diamond Model and Pyramid of Pain, validate via purple teaming and attack simulation, and report metrics such as alert fidelity, false positive rates and MTTD.
• Maintain audit-ready documentation and ensure critical log sources support detection objectives.

Required profile

• 8+ years of cybersecurity experience, with at least 4 years in Detection Engineering or Threat Detection.
• Proven experience building or leading enterprise detection engineering functions.
• Bachelor's degree in Computer Science, Information Security, Engineering or a related field; cybersecurity certifications are highly desirable.
• Preferred: banking experience, threat hunting or cyber threat intelligence background, and experience in highly regulated environments.

Required skills

• Expert knowledge of Microsoft Sentinel, IBM QRadar, threat detection engineering, security monitoring and threat intelligence integration.
• Strong expertise in KQL, AQL, Detection-as-Code, Git and CI/CD pipelines.
• Deep understanding of MITRE ATT&CK, MITRE D3FEND, NIST CSF, Cyber Kill Chain, Diamond Model and Pyramid of Pain.
• Detections across Windows, Linux, Azure, Microsoft 365 Identity Services and network security platforms.
• Scripting in Python and PowerShell.
• Preferred: Sigma, YARA, MISP, Recorded Future, Microsoft Defender XDR, EDR, Red/Purple Teaming and certifications such as GIAC GCD, GCIH, GREM, SC-200, QRadar, CISSP, OSCP, CPE.