SOC Detection Engineer Hybrid - IR35

A Senior SOC Detection Engineer responsible for designing, developing, and continuously improving threat-led detection capabilities across a large enterprise. The role translates cyber threat intelligence, red team findings, and incident learnings into high-fidelity detection logic, owning the full detection content life cycle from threat analysis through to tuning, optimisation, and retirement. This is a specialist detection engineering role and is not focused on day-to-day SIEM administration or platform operations.

• Design, develop, and maintain threat-led detection content aligned to MITRE ATT&CK and organisational threat models, translating threat intelligence, hunting findings, and red/purple team outcomes into effective detections.
• Develop behavioural, risk-based, and correlated detections across endpoint, identity, cloud, network, email, and application telemetry, continuously tuning and optimising logic to reduce false positives.
• Assess detection coverage, identify telemetry and visibility gaps, and define requirements for improved monitoring across the enterprise security estate.
• Validate detections through attack simulation, purple teaming, and adversary emulation exercises, maintaining detection content documentation, version control, and Detection-as-Code practices.
• Develop automation to support detection testing, validation, reporting, and life cycle management, including AI-enabled hypothesis generation and automated rule creation pipelines.

• Threat-led detection engineering - 8+ years in detection engineering, threat hunting, or security operations, with demonstrable experience creating behavioural detections for sophisticated adversaries aligned to MITRE ATT&CK, including full detection life cycle management.
• SIEM & EDR platform expertise - Proven experience developing enterprise-scale detections within platforms such as Microsoft Sentinel, Splunk, Elastic, or Chronicle, alongside endpoint telemetry from Microsoft Defender, Crowd Strike, Sentinel One, or equivalent EDR/XDR platforms.
• Detection analytics & automation - Strong proficiency in KQL, SPL, Sigma, Python, and Power Shell for detection logic development, data correlation, Detection-as-Code practices, and automation of SOC analyst activities.
• Threat analysis & adversary tradecraft - Deep knowledge of threat intelligence, adversary TTP analysis, attack path analysis, and threat hunting methodologies, with strong understanding of attacker tradecraft and common attack techniques.
• Security domain breadth - Solid knowledge across Identity & Access Management, Active Directory, Cloud Security, Endpoint Security, Network Security, and Email Security, with experience supporting purple team and adversary emulation activities.

• Rate: £425- £475 per day Inside IR35
• Location:
  Hybrid in one of Leamington Spa, Manchester or Warrington (2/3x a week)
• Duration: 6 Month Initial Contract