SOC Detection Engineer

Location:

Leamington Spa / Manchester / Warrington Working Pattern:
Hybrid, 3 days onsite Contract Duration: 6 months Positions Available: 3

We are looking for experienced SOC Detection Engineers to design, develop and continuously improve threat-led detection capabilities across an enterprise security environment.

You will translate cyber threat intelligence, threat modelling outputs, threat hunting findings, red/purple team exercises and incident learnings into high-fidelity detection logic that identifies sophisticated attacker behaviour while minimising false positives.

This is a specialist detection engineering position focused on attacker behaviour analytics, detection coverage, security telemetry, detection automation and continuous improvement.

The role is not primarily focused on day-to-day SIEM administration or platform support.

• Design, develop and maintain threat-led detection rules aligned with MITRE ATT&CK and organisational threat models.

• Translate threat intelligence, threat hunting insights, red/purple team findings and incident investigations into effective detection use cases.

• Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.

• Continuously tune and optimise detection logic to improve detection accuracy, reduce false positives and strengthen SOC effectiveness.

• Assess detection coverage, identify telemetry gaps and define requirements for improved security monitoring.

• Validate detection capabilities through attack simulation, purple teaming and adversary emulation.

• Maintain detection documentation, version control and engineering standards, including Detection-as-Code practices.

• Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams.

• Develop automation for detection testing, validation, reporting and lifecycle management.

• Identify opportunities to automate repetitive SOC analyst activities.

• Contribute to AI-enabled detection hypothesis generation and automated rule creation pipelines.

• Strong hands-on experience in SOC Detection Engineering, including detection rule development, validation, tuning and lifecycle management.

• Excellent knowledge of MITRE ATT&CK, attacker TTPs, behavioural analytics and threat-led detection methodologies.

• Experience translating cyber threat intelligence, threat modelling and threat hunting findings into operational detection logic.

• Practical experience developing detection content using KQL, SPL, Sigma, Python and Power Shell.

• Strong understanding of security telemetry across endpoint, identity, cloud, network, authentication and application environments.

• Experience with detection correlation, threat analysis and Detection-as-Code methodologies.

• Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness.

• Knowledge of Active Directory, IAM, cloud security, endpoint security, network security and email security.

• Ability to identify monitoring gaps, improve detection coverage and reduce false positives.

• Experience collaborating with SOC, Threat Intelligence, Incident Response and offensive security teams.

• Experience developing enterprise-scale detections using Microsoft Sentinel, Splunk, Elastic or Google Chronicle.

• Experience creating detections using telemetry from Microsoft Defender, Crowd Strike, Sentinel One or equivalent EDR/XDR platforms.

• Hands-on involvement in purple teaming, adversary emulation and attack simulation.

• Experience creating behavioural detections for sophisticated threat actors.

• Experience automating detection testing and validation processes.

• Experience supporting AI-enabled detection engineering or automated rule creation.

• Relevant degree in Cybersecurity, Computer Science, Digital Forensics, Information Security or equivalent experience.