Senior Detection Engineer in banking domain

We have an urgent requirement for Senior Detection Engineer in banking domain (Must) is required for our banking clients in Abu Dhabi ,UAE

Establish and lead the detection engineering practice, including strategy, governance, detection-as-code processes, quality standards, team mentoring, and stakeholder reporting.

--

Must

Develop and enhance intelligence-led threat detections by converting CTI, threat hunting, and incident response findings into actionable security detections aligned with emerging threats--

Must

Design, build, tune, and maintain advanced detections in Microsoft Sentinel (KQL) and IBM QRadar (AQL), leveraging behavioral analytics, Sigma, SOAR integrations, and CI/CD-based detection management.

-

-Must

Measure and improve detection coverage using MITRE ATT&CK, D3

FEND, NIST CSF, Cyber Kill Chain, conduct adversary emulation/purple team testing, and optimize detection performance through continuous tuning and metrics analysis.

--

Must

Banking Domain --

Must

We're hiring a Senior Detection Engineer to set up, lead and develop our detection engineering function. You'll own the strategy, design and delivery of intelligence-driven threat detection across IBM QRadar and Microsoft Sentinel. The aim is for detection coverage to reflect the organisation's threat profile, business risks and regulatory obligations.

This is both a leadership and a hands-on technical role. You'll set the standards for how detections are built, tested, deployed, measured and retired. You'll also work closely with cyber threat intelligence, incident response, threat hunting, red team and risk functions so detection capability keeps pace with emerging threats.

• Design and set up the detection engineering function, including its operating model, roles, processes, governance and roadmap.
• Define and run a detection-as-code lifecycle covering requirements, development, peer review, testing, deployment, tuning and retirement.
• Set detection standards, naming conventions, documentation requirements and quality controls.
• Lead, mentor and develop detection engineers and analysts, building capability and a strong engineering culture.
• Present detection strategy, coverage and risk position to senior management, risk committees and auditors.

• Turn cyber threat intelligence (CTI) into prioritised, actionable detection requirements based on the threats most relevant to the organisation.
• Model threat actors and attack campaigns, including ransomware groups, financially motivated actors, APTs, fraud and insider threats.
• Work with CTI, threat hunting and incident response teams to close the loop: turn hunt findings, incident lessons and intelligence reports into durable detections.
• Use industry and sector intelligence sources such as ISACs, vendor reporting and government advisories to shape detection priorities.

• Map and measure detection coverage against MITRE ATT&CK and apply MITRE D3
  
  FEND, the Cyber Kill Chain, the Pyramid of Pain and the Diamond Model to shape detection design.
• Align detection capability with the NIST Cybersecurity Framework, ISO 27001, PCI DSS and other relevant regulatory and industry standards.
• Run threat-informed coverage assessments, identify gaps and prioritise the roadmap by risk.
• Apply detection maturity models (e.g., the Detection Maturity Level model) and report progress over time.

• Design, build and tune advanced detections in Microsoft Sentinel (KQL) and IBM QRadar (AQL, rules, building blocks, reference data).
• Develop behavioural, anomaly-based and correlation detections, not just indicator-based rules.
• Use vendor-neutral formats such as Sigma and…