Detection Engineer (SIEM, EDR/XDR, SOAR)

About the role

This role leads the development, implementation and continuous improvement of security detection across SIEM, EDR/XDR and SOAR platforms. It ensures effective threat detection, monitoring coverage, alert quality and automation to strengthen the organisation's cyber defence.

Key responsibilities

• Lead SIEM, EDR/XDR and SOAR detection content development and manage the detection use-case lifecycle, including validation and quality assurance.
• Coordinate threat hunting and detection gap assessments, and improve enterprise detection coverage and maturity.
• Drive detection automation and continuous optimisation, and align capabilities with emerging threats and attack techniques.
• Monitor and optimise detection performance and alert quality, track coverage, tuning and operational KPIs, and support complex incident investigations.
• Address detection gaps, perform root cause analysis and provide technical documentation and team mentoring.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related field.
• 7-10 years of cybersecurity experience, with a strong focus on detection engineering, SIEM or threat detection.

Required skills

• Advanced SIEM detection rules and correlation search development; strong SPL, KQL or equivalent query languages.
• EDR/XDR detection engineering and MITRE ATT&CK mapping.
• SOAR playbook integration and Python, PowerShell or Bash scripting.
• Threat intelligence and IOC integration, log parsing and telemetry validation.
• Detection metrics, dashboards and reporting, plus threat hunting and cloud, network, endpoint and OT/IoT detection concepts.