SOC Detection Engineer

Senior SOC Detection Engineer | 6-Month Contract

Location: Leamington Spa / Manchester / Warrington Working Pattern: Hybrid, 3 days onsite Contract Duration: 6 months Positions Available: 3

The Role

We are looking for experienced SOC Detection Engineers to design, develop and continuously improve threat-led detection capabilities across an enterprise security environment.

You will translate cyber threat intelligence, threat modelling outputs, threat hunting findings, red/purple team exercises and incident learnings into high-fidelity detection logic that identifies sophisticated attacker behaviour while minimising false positives.

This is a specialist detection engineering position focused on attacker behaviour analytics, detection coverage, security telemetry, detection automation and continuous improvement.

The role is not primarily focused on day-to-day SIEM administration or platform support.

Key Responsibilities

• Design, develop and maintain threat-led detection rules aligned with MITRE ATT&CK and organisational threat models.




• Translate threat intelligence, threat hunting insights, red/purple team findings and incident investigations into effective detection use cases.




• Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.




• Continuously tune and optimise detection logic to improve detection accuracy, reduce false positives and strengthen SOC effectiveness.




• Assess detection coverage, identify telemetry gaps and define requirements for improved security monitoring.




• Validate detection capabilities through attack simulation, purple teaming and adversary emulation.




• Maintain detection documentation, version control and engineering standards, including Detection-as-Code practices.




• Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams.




• Develop automation for detection testing, validation, reporting and lifecycle management.




• Identify opportunities to automate repetitive SOC analyst activities.




• Contribute to AI-enabled detection hypothesis generation and automated rule creation pipelines.

Essential Skills and Experience

• Strong hands-on experience in SOC Detection Engineering, including detection rule development, validation, tuning and lifecycle management.




• Excellent knowledge of MITRE ATT&CK, attacker TTPs, behavioural analytics and threat-led detection methodologies.




• Experience translating cyber threat intelligence, threat modelling and threat hunting findings into operational detection logic.




• Practical experience developing detection content using KQL, SPL, Sigma, Python and PowerShell.




• Strong understanding of security telemetry across endpoint, identity, cloud, network, authentication and application environments.




• Experience with detection correlation, threat analysis and Detection-as-Code methodologies.




• Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness.




• Knowledge of Active Directory, IAM, cloud security, endpoint security, network security and email security.




• Ability to identify monitoring gaps, improve detection coverage and reduce false positives.




• Experience collaborating with SOC, Threat Intelligence, Incident Response and offensive security teams.

Desirable Experience

• Experience developing enterprise-scale detections using Microsoft Sentinel, Splunk, Elastic or Google Chronicle.




• Experience creating detections using telemetry from Microsoft Defender, CrowdStrike, SentinelOne or equivalent EDR/XDR platforms.




• Hands-on involvement in purple teaming, adversary emulation and attack simulation.




• Experience creating behavioural detections for sophisticated threat actors.




• Experience automating detection testing and validation processes.




• Experience supporting AI-enabled detection engineering or automated rule creation.




• Relevant degree in Cybersecurity, Computer Science, Digital Forensics, Information Security or equivalent experience.

#J-18808-Ljbffr