Lead Content Detection Engineer National Security West

Location(s):

UK, Europe & Africa : UK :
Leeds

BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts. We work collaboratively across 10 countries to collect, connect and understand complex data, so that governments, nation states, armed forces and commercial businesses can unlock digital advantage in the most demanding environments.

Job Title:
Lead Content Detection Engineer
Requisition

Location:
Leeds

Grade: GG10

Referral Bonus: £5,000

BAE Systems is recruiting an experienced Detection Engineering Lead to join our Security Operations Centre (SOC) supporting a Critical National Infrastructure (CNI) client. This role is a combination of technical and leadership and is responsible for setting the strategic direction of our Detection Engineering function, managing a small team of detection engineers, and ensuring the delivery of world‑class security detection capabilities.

As the Detection Engineering Lead, you will take full ownership of the detection strategy, team development, and service delivery, working closely with senior stakeholders to meet contractual KPIs and drive continuous improvement across the function. This role reports directly to the Service Delivery Manager, but also will work closely with the threat intelligence lead and the SOC manager.

In this role, you will define and maintain the overall detection strategy and roadmap for the Detection Engineering function, ensuring all initiatives and deliverables align to KPIs. You will be responsible for driving the direction of the engineering function, identifying opportunities for service improvements and efficiency enhancements through automation and tooling.

As a people manager, you will lead the Detection Engineering team's workload and professional development. This includes conducting regular meetings with your team to ensure they have the necessary support. You will foster a culture of continuous learning and technical excellence, through the delivery of knowledge to junior members of your team.

Operational ownership is a critical aspect of this position. You will take responsibility for business‑as‑usual operations and service improvement initiatives. Your ability to balance strategic thinking with operational accountability will be essential to success in this role.

Stakeholder engagement is a key responsibility. You will communicate detection efficacy;
Key Performance Indicators; and continuous service improvements to the Service Delivery Manager, executives, and wider customer teams. The role requires you to make key strategic decisions, and advocate effectively for your team's requirements at senior levels.

• Advanced proficiency in both Splunk and Microsoft Sentinel SIEM platforms
• Understanding and experience with AWS and Azure cloud environments
• An advanced understanding of KQL and SPL to write detections that are efficient, and high‑fidelity
• Strong Python programming skills for developing and maintaining existing automation and Detection as Code pipelines
• Experience monitoring networks and working with threat intelligence, ideally understanding the MITRE ATT&CK framework
• Strong understanding of security detection methodologies and best practices
• Experience creating and presenting strategic direction and managing workloads
• Excellent communication and stakeholder management skills

• Experience with Detection as Code methodologies
• Proficiency in React or JavaScript for tooling development
• Experience in people management and team leadership

Whilst not essential, the following courses and certifications are desirable, and we encourage and support successful candidates to continue their professional development, which can include:

• SANS courses: SEC
  599, SEC
  530, SEC
  699, FOR
  608, SEC
  541
• GIAC certifications: GDAT, GCIH, GCDA, GMON, GSOC, GDSA, GCED
• Other certifications: CISSP, ISSEP, CCSP;
  Vendor specific certifications from Splunk, AWS, or Microsoft

The ideal candidate will be a strategic thinker with strong decision‑making capabilities and a proactive approach to problem‑solving and continuous…