Detection Engineering Lead - SIEM and Threat Detection

Detection Engineering Lead - SIEM and Threat Detection. Role:
Detection Engineering Lead - SIEM and Threat Detection.

Location:

Abu Dhabi, United Arab Emirates. Industry: Banking. Function:
Computer-Network Security.

Experience:

Minimum 8 years in cybersecurity, including at least 4 years in detection engineering, threat detection or SOC engineering. Job Type: Full Time. Work Arrangement:
On-site

Dicetek LLC is seeking an experienced Detection Engineering Lead to support enterprise threat detection capabilities in Abu Dhabi, United Arab Emirates. The role requires a cybersecurity professional with proven experience designing or leading a detection engineering function within a large or regulated organisation. The successful candidate will combine strategic leadership with expert-level technical capabilities in Microsoft Sentinel, IBM QRadar and intelligence-driven detection development.

The position focuses on translating cyber threat intelligence into actionable security detections, applying recognised adversary frameworks and establishing effective detection engineering practices. Strong expertise in detection-as-code, security analytics, SIEM engineering and automated detection deployment is essential. The role also requires the ability to communicate detection effectiveness to executives, auditors and regulators while mentoring technical teams and supporting structured decision-making during significant security incidents.

• Country:
  United Arab Emirates
• City:
  Abu Dhabi
• Industry: Banking
• Function:
  Computer-Network Security
• Salary:
  Not disclosed
• Gender: No Preference
• Candidate Nationality:
  Not specified
• Job Type: Full Time
• Work Arrangement:
  On-site

• Lead the design and development of an enterprise detection engineering function.
• Establish effective detection engineering practices aligned with organisational cyber risks.
• Provide technical leadership across security detection development and improvement activities.
• Prioritise detection engineering efforts using threat intelligence and business risk considerations.
• Promote consistent engineering standards and technical quality.
• Guide team members in developing and maintaining effective detection capabilities.
• Communicate detection priorities, coverage and limitations to relevant stakeholders.
• Microsoft Sentinel Detection Engineering
  - Develop advanced threat detections using Microsoft Sentinel.
• Write and optimise Kusto Query Language (KQL) queries.
• Design and maintain Sentinel analytics rules.
• Develop workbooks supporting detection visibility and security analysis.
• Configure and maintain watchlists used in detection scenarios.
• Apply Sentinel automation capabilities to relevant security workflows.
• Troubleshoot detection logic and investigate gaps in monitoring coverage.
• Maintain effective detection content across relevant Microsoft security environments.
• IBM QRadar Detection Engineering
  - Develop and maintain security detections within IBM QRadar.
• Use Ariel Query Language (AQL) for security event analysis.
• Configure and optimise custom correlation rules.
• Develop and maintain QRadar building blocks.
• Work with Device Support Modules (DSMs) to support relevant event processing requirements.
• Configure and maintain reference sets used in detection logic.
• Investigate detection effectiveness and technical issues affecting QRadar security monitoring.
• Intelligence-Driven Threat Detection
  - Translate cyber threat intelligence into operational detection use cases.
• Analyse attacker tactics, techniques and procedures to identify relevant detection opportunities.
• Apply MITRE ATT&CK to structure and prioritise threat detection coverage.
• Use MITRE D3
  
  FEND concepts to support understanding of defensive countermeasures.
• Apply the Cyber Kill Chain, Diamond Model and Pyramid of Pain when analysing adversary behaviour.
• Consider NIST Cybersecurity Framework principles when aligning detection capabilities with organisational security objectives.
• Maintain a threat-informed approach to detection development and improvement.
• Prioritise security detections according to relevant threat activity and business risk.
• Detection-as-Code and Engineering Automation
  - Apply detection-as-code practices to security detection development.
• Use Git-based version control for detection content.
• Support CI/CD pipelines for managing detection changes.
• Maintain traceable and controlled detection engineering workflows.
• Develop scripts using Python and/or Power Shell.
• Support repeatable testing and deployment of detection content.
• Promote…