SOC Detection Engineer

The Role
The Senior Detection Engineer is responsible for designing, developing and continuously improving threat-led detection capabilities that identify sophisticated attacker behaviors across the enterprise.
The role translates cyber threat intelligence, threat modelling outputs, red team findings, threat hunting insights and incident learnings into high-fidelity detection logic capable of identifying malicious activity while minimising false positives.
The individual owns the end-to-end life cycle of detection content, from threat analysis and hypothesis development through to detection design, validation, tuning, optimisation and retirement.
This is a specialist detection engineering role focused on attacker behavior analytics, detection coverage, telemetry strategy and continuous improvement of detection effectiveness. The role is not primarily responsible for day-to-day SIEM administration, platform support or security tooling operations.
Your responsibilities:
1. Design, develop and maintain threat-led detection content aligned to MITRE ATT&CK and organisational threat models.
2. Translate threat intelligence, threat hunting findings, red/purple team outcomes and incident lessons learned into effective detections.
3. Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.
4. Continuously tune and optimise detection logic to improve detection fidelity, reduce false positives and enhance SOC effectiveness.
5. Assess detection coverage, identify telemetry and visibility gaps, and define requirements for improved monitoring and detection.
6. Validate detections through attack simulation, purple teaming and adversary emulation exercises.
7. Maintain detection content documentation, ownership, version control and engineering standards, including Detection-as-Code practices where applicable.
8. Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams to continuously improve detection capabilities.
9. Identify opportunities to automate repetitive SOC analyst activities.
10. Develop automation to support detection testing, validation, reporting and life cycle management.
11. Design AI enabled hypotheses generate and automated rule creation pipeline.
Your Profile
Essential skills/knowledge/experience:
1. Detection Engineering: Threat-l...