Security Engineer Detection Engineering & Automation in London

We are seeking a Security Engineer specialising in Detection Engineering and Security Automation to design, build, and operate scalable detection and response capabilities across cloud and enterprise environments. This role focuses on engineering high-fidelity detections and automating response workflows across platforms such as Rapid7, SentinelOne, and CrowdStrike, using Azure Logic Apps and API-driven integrations to reduce manual effort and improve response speed. This is a hands-on engineering role for someone who thinks in attacker behaviours, builds resilient automation, and prefers engineering solutions over manual SOC processes.

Key Responsibilities

• Detection Engineering
  • Design, implement, and continuously improve threat detections across endpoint, identity, vulnerability, and cloud telemetry.
  • Engineer detections using data from Rapid7, SentinelOne, and CrowdStrike, including behavioural, anomaly-based, and contextual detections.
  • Translate MITRE ATT&CK techniques and real-world threat intelligence into actionable detection logic.
  • Develop and tune detection logic to reduce false positives while preserving signal quality.
  • Validate detections through testing, attack simulation, and post-incident review.
  • Maintain detection coverage mapping across the attack lifecycle.
• Security Automation & SOAR
  • Design and implement security automation workflows using Azure Logic Apps to support alert triage, enrichment, containment, and response.
  • Automate workflows such as alert enrichment from asset inventories and vulnerability data, risk-based prioritisation using exploitability and exposure context, endpoint containment or isolation actions, and case creation, updates, and closure across security platforms.
  • Integrate tools via REST APIs, webhooks, and managed connectors.
  • Build modular, reusable automation components with robust error handling and observability.
• Platform Integration & Engineering
  • Integrate and correlate telemetry across Rapid7, SentinelOne, CrowdStrike, and supporting security systems.
  • Work closely with security and cloud teams to onboard new data sources and ensure data quality.
  • Apply detection-as-code and automation-as-code principles using version control and structured deployment processes.
  • Build dashboards and metrics to measure detection efficacy, alert quality, and automation impact.
• Incident Response & Continuous Improvement
  • Support incident response by enhancing detections and automations based on real incidents.
  • Feed learnings from investigations back into detection logic and response workflows.
  • Maintain documentation, playbooks, and runbooks for detections and automations.
  • Contribute to purple-team activities and detection gap analysis.

Required Skills, Experience and Qualifications

• Proven experience in detection engineering, security operations engineering, or security automation roles.
• Hands-on experience with Rapid7, SentinelOne, and/or CrowdStrike in detection or response contexts.
• Strong experience building automation using Azure Logic Apps.
• Proficiency integrating systems using REST APIs, JSON payloads, authentication, and pagination.
• Solid understanding of endpoint security, vulnerability management, and attacker tradecraft.
• Deep familiarity with MITRE ATT&CK and behaviour-based detection methodologies.

Engineering & Operational Skills

• Strong scripting or engineering background (e.g. Python, PowerShell).
• Experience working with structured data, event pipelines, and telemetry correlation.
• Understanding of alert lifecycle management and incident response workflows.
• Ability to design automation that is safe, resilient, and auditable.

Preferred Experience

• Correlating endpoint, vulnerability, and asset data for risk-based detection.
• Familiarity with SOAR design patterns and automation governance.
• Exposure to cloud security telemetry and identity-based attack detection.
• Experience operating in large-scale or regulated environments.
• Knowledge of CI/CD or infrastructure-as-code approaches for security tooling.

About us

We’re a diverse group of visionary innovators who provide trading and workflow automation software, high-value analytics, and strategic consulting to corporations, central banks, financial institutions, and governments. Founded in 1999, we’ve achieved tremendous growth by bringing together some of the best and most successful financial technology companies in the world. Over 2,000 of the world’s leading corporations, including 50% of the Fortune 500 and 30% of the world’s central banks, trust ION solutions to manage their cash, in-house banking, commodity supply chain, trading and risk. Over 800 of the world’s leading banks and broker-dealers use our electronic trading platforms to operate the world’s financial market infrastructure. ION is a rapidly expanding and dynamic group with 13,000 employees and offices in more than 40 cities around the globe. Our ever-expanding global footprint, cutting-edge products, and over 40,000 customers worldwide provide an unparalleled career experience for those who share our vision. ION is committed to maintaining a supportive and inclusive environment for people with diverse backgrounds and experiences. We respect the varied identities, abilities, cultures, and traditions of the individuals who comprise our organization and recognize the value that different backgrounds and points of view bring to our business. ION adheres to an equal employment opportunity policy that prohibits discriminatory practices or harassment against applicants or employees based on any legally impermissible factor.