Associate Cyber Detections Engineer in Hounslow

We don't just believe in better. We make it happen.

Better content. Better products. And better careers.

Working in Tech, Product or Data at Sky is about building the next and the new.

From broadband to broadcast, streaming to mobile, Sky Stream to Sky Glass, we never stand still.

We optimise and innovate.

We turn big ideas into the products, content and services millions of people love.

And we do it all right here at Sky.

The Associate Cyber Detections Engineer will support platform log ingestion and transformation, plus the design, development, testing, tuning, and maintenance of security detection content across the organisation's cyber monitoring platforms.

The role is suited to an early-career engineer with strong analytical ability, curiosity about technology, and a practical interest in using log events to identify suspicious or malicious activity.

This role helps improve the organisation's ability to detect cyber threats quickly and accurately by collecting correct and accurate logs and creating/maintaining reliable detection rules to use them, with supporting documentation.

Working with senior detection engineers, SOC analysts, incident responders, and platform teams, the Associate Cyber Detections Engineer will help convert threat intelligence, use cases, and operational requirements into effective, measurable detections.

What you'll do

• Develop, test, tune, and maintain SIEM detection rules to identify suspicious activity across security, infrastructure, cloud, and application telemetry.
• Write and optimise SIEM queries, particularly using SQL and Splunk Search Processing Language (SPL), to support detection engineering, threat hunting, and investigation use cases.
• Assist with translating threat intelligence, attack techniques, incident learnings, and control requirements into practical detection logic.
• Review detection performance, investigate false positives, and recommend tuning improvements to increase fidelity and reduce unnecessary alert noise.
• Use Linux command-line tools to inspect logs, validate data, troubleshoot ingestion issues, and support investigation or engineering tasks.
• Document detection logic, assumptions, test evidence, dependencies, known limitations, and operational response guidance.
• Work with SOC, incident response, platform engineering, and cloud teams to understand telemetry sources and ensure detections are actionable for analysts.
• Support detection lifecycle activities, including peer review, version control, testing, deployment, monitoring, and periodic review.
• Contribute to continuous improvement of detection coverage across common adversary behaviours, cloud activity, identity events, endpoint telemetry, and network logs.
• What you'll bring

The ideal candidate is analytical, technically curious, and comfortable working with log data and security tools.

They do not need to be a fully experienced detection engineer, but they should be able to demonstrate hands‑on querying ability, a methodical approach to troubleshooting, and a strong interest in building reliable security detections.

They should be comfortable collaborating with others, learning from senior engineers, and improving their technical skills over time.

Essential criteria

• Practical experience writing SIEM queries, especially using SQL and Splunk SPL.
• Understanding of SIEM detection rules, correlation searches, alert logic, and the importance of detection quality and tuning.
• Comfortable using the Linux command line for searching files, inspecting logs, running commands, navigating file systems, and troubleshooting basic issues.
• Ability to analyse log data and identify meaningful patterns, anomalies, or behaviours that may indicate security risk.
• Basic understanding of cyber security concepts, including common attack techniques, security monitoring, incident response, and log sources.
• Good written communication skills, with the ability to document technical logic clearly for both engineers and analysts.

Desirable skills and experience

• Familiarity with AWS cloud services, particularly EC2, IAM and VPC
• Exposure to infrastructure as code and configuration management tools, particularly Terraform and Ansible.
• Experience using Git or other version control systems to manage scripts, configuration, or detection content.
• Awareness of MITRE ATT&CK and how adversary tactics, techniques, and procedures can be mapped to detection coverage.
• Basic scripting experience, such as Bash or Python, to automate repeatable analysis or engineering tasks.
• Experience working in, or closely with, a SOC, security engineering, cloud engineering, or infrastructure operations team.

Benefits and perks

• Free Sky TV or NOW package, including Sky Sports and Sky Cinema
• Pension package with up to 9% employer contribution
• Private healthcare with mental health support
• Aviva Digital GP and de
• #J-18808-Ljbffr