Find a job 
Featured Companies 
Featured Universities 
For Companies At a Glance
- Tasks: Design and develop high-quality detection logic for cyber threats using the MITRE ATT&CK framework.
- Company: Join a leading cybersecurity firm with a focus on innovation and collaboration.
- Benefits: Competitive daily rate, remote work flexibility, and opportunities for professional growth.
- Other info: Work in a dynamic environment with opportunities for career advancement.
- Why this job: Make a real impact in cybersecurity by developing effective detection strategies.
- Qualifications: Experience with Microsoft Defender, Splunk, KQL, and strong analytical skills required.
The predicted salary is between 48000 - 72000 £ per year.
Location: Remote with occasional travel to Welwyn Garden City
Employment: Contract (3 months)
Rate: £600/Day Inside
THE ROLE
To design, develop and maintain high-quality detection logic aligned with the MITRE ATT&CK framework. The role involves close collaboration with SOC analysts, incident responders and threat intelligence teams to develop high-impact, context-rich use cases across Windows, Linux and cloud environments. This position demands a balance of technical depth, analytical thinking and strong content development skills to ensure detections are both effective and operationally relevant.
KEY RESPONSIBILITIES
- Design, develop, and maintain robust detection content aligned to MITRE ATT&CK and threat-led priorities.
- Build and optimise detection queries using KQL, applying efficiency and best practices in logic construction.
- Support the full detection engineering lifecycle, including modelling, data onboarding, rule development, deployment, and iterative tuning.
- Collaborate with SOC and threat intelligence teams to validate alert quality, minimise false positives, and ensure operational relevance.
- Maintain detection-as-code repositories in GitHub, ensuring proper version control, peer review, and documentation standards.
- Document all detection content with clear context, data dependencies, and investigation guidance.
SKILLS
- Strong hands-on experience with Microsoft Defender (Endpoint, Cloud, Identity) and Splunk Enterprise Security.
- Proficiency in KQL and SPL, with the ability to optimise query performance and maintain clarity of logic.
- Demonstrated experience with detection-as-code practices using GitHub or similar version control platforms.
- Deep understanding of MITRE ATT&CK, threat actor TTPs, and translating them into detection use cases.
- Familiarity with enterprise logging, data onboarding, and schema normalisation.
- Working knowledge of Sentinel, Defender for Endpoint, Splunk ES, Jira, and Confluence.
- Strong written communication skills for content development, documentation, and stakeholder collaboration.
Locations
Cyber Security Consultant employer: Lorien
Contact Detail:
Lorien Recruiting Team
We think you need these skills to ace Cyber Security Consultant
How to prepare for a job interview at Lorien
✨Know Your MITRE ATT&CK
Make sure you’re well-versed in the MITRE ATT&CK framework. Be prepared to discuss how you've applied it in your previous roles, especially in designing detection logic. This shows you understand the core of what the role demands.
✨Showcase Your Technical Skills
Brush up on your KQL and SPL skills before the interview. Be ready to explain how you've optimised queries in the past and share examples of detection content you've developed. This will demonstrate your hands-on experience and technical depth.
✨Collaboration is Key
Since the role involves working closely with SOC analysts and threat intelligence teams, be prepared to discuss your experience in collaborative environments. Share specific examples of how you’ve worked with others to validate alert quality and minimise false positives.
✨Documentation Matters
Highlight your experience with documentation standards and version control, especially using GitHub. Discuss how you ensure clarity and context in your detection content, as this is crucial for operational relevance and team collaboration.