SOC Detection Engineer in London

Senior SOC Detection Engineer | 6-Month Contract

Location: Leamington Spa / Manchester / Warrington Working Pattern: Hybrid, 3 days onsite Contract Duration: 6 months Positions Available: 3

The Role

We are looking for experienced SOC Detection Engineers to design, develop and continuously improve threat-led detection capabilities across an enterprise security environment.
You will translate cyber threat intelligence, threat modelling outputs, threat hunting findings, red/purple team exercises and incident learnings into high-fidelity detection logic that identifies sophisticated attacker behaviour while minimising false positives.
This is a specialist detection engineering position focused on attacker behaviour analytics, detection coverage, security telemetry, detection automation and continuous improvement.
The role is not primarily focused on day-to-day SIEM administration or platform support.

Key Responsibilities

Design, develop and maintain threat-led detection rules aligned with MITRE ATT&CK and organisational threat models.

Translate threat intelligence, threat hunting insights, red/purple team findings and incident investigations into effective detection use cases.

Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.

Continuously tune and optimise detection logic to improve detection accuracy, reduce false positives and strengthen SOC effectiveness.

Assess detection coverage, identify telemetry gaps and define requirements for improved security monitoring.

Validate detection capabilities through attack simulation, purple teaming and adversary emulation.

Maintain detection documentation, version control and engineering standards, including Detection-as-Code practices.

Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams.

Develop automation for detection testing, validation, reporting and lifecycle management.

Identify opportunities to automate repetitive SOC analyst activities.

Contribute to AI-enabled detection hypothesis generation and automated rule creation pipelines.

Essential Skills and Experience

Strong hands-on experience in SOC Detection Engineering, including detection rule development, validation, tuning and lifecycle management.

Excellent knowledge of MITRE ATT&CK, attacker TTPs, behavioural analytics and threat-led detection methodologies.

Experience translating cyber threat intelligence, threat modelling and threat hunting findings into operational detection logic.

Practical experience developing detection content using KQL, SPL, Sigma, Python and PowerShell.

Strong understanding of security telemetry across endpoint, identity, cloud, network, authentication and application environments.

Experience with detection correlation, threat analysis and Detection-as-Code methodologies.

Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness.

Knowledge of Active Directory, IAM, cloud security, endpoint security, network security and email security.

Ability to identify monitoring gaps, improve detection coverage and reduce false positives.

Experience collaborating with SOC, Threat Intelligence, Incident Response and offensive security teams.

Desirable Experience

Experience developing enterprise-scale detections using Microsoft Sentinel, Splunk, Elastic or Google Chronicle.

Experience creating detections using telemetry from Microsoft Defender, CrowdStrike, SentinelOne or equivalent EDR/XDR platforms.

Hands-on involvement in purple teaming, adversary emulation and attack simulation.

Experience creating behavioural detections for sophisticated threat actors.

Experience automating detection testing and validation processes.

Experience supporting AI-enabled detection engineering or automated rule creation.

Relevant degree in Cybersecurity, Computer Science, Digital Forensics, Information Security or equivalent experience.

Apply

For more information or to apply directly, please email I review applications daily and will contact shortlisted candidates as quickly as possible.