Find a job 
Featured Companies 
Featured Universities 
For Companies At a Glance
- Tasks: Design and build security detections to protect against cyber threats.
- Company: Join a leading cybersecurity firm focused on innovation and teamwork.
- Benefits: Enjoy remote work, competitive salary, and opportunities for professional growth.
- Why this job: Make a real difference in cybersecurity by creating impactful detection solutions.
- Qualifications: Hands-on experience with KQL and SPL, plus a passion for security.
- Other info: Dynamic role with potential for career advancement in a fast-paced environment.
The predicted salary is between 60000 - 80000 £ per year.
This role is for a hands-on detection engineer whose primary job is designing, building and maintaining security detections.
You will spend the majority of your time:
- Writing detection logic
- Improving signal quality
- Expanding ATT&CK coverage
- Testing and tuning detections
- Working with threat intel and incident response to convert findings into new detections
This is not a SOC analyst, SIEM administrator, SecOps generalist, cloud security, IAM, or vulnerability management role.
Responsibilities:
- Design and implement behaviour based detections in Microsoft Sentinel (KQL) and Splunk (SPL)
- Own detection logic end-to-end: creation, testing, tuning, false-positive reduction, lifecycle management
- Map detections to MITRE ATT&CK and track coverage gaps
- Maintain and improve a detection library over time
- Validate detections using: threat hunting, incident learnings, testing frameworks (e.g. Atomic Red Team)
- Work closely with IR and SOC teams, but not perform SOC triage
- Treat detections as a product, not one-off alerts
Skills:
- Hands-on experience authoring detections, not just using SIEMs
- Strong KQL experience writing Sentinel analytics rules
- Strong SPL experience writing Splunk correlation searches
- Experience maintaining detections in production environments
- Clear examples of reducing false positives through logic changes
- Ability to explain why a detection exists, not just how it works
Preferred:
- Experience running or contributing to a detection engineering function
- Detection-as-code (Git, CI/CD, IaC)
- ATT&CK-driven detection coverage modelling
- Threat hunting that directly feeds detection creation
- Experience migrating detections between SIEM platforms
Senior Detection Engineer - Remote in London employer: RiverSafe
Contact Detail:
RiverSafe Recruiting Team
StudySmarter Expert Advice 🤫
We think this is how you could land Senior Detection Engineer - Remote in London
✨Tip Number 1
Get your hands dirty with the tools! Familiarise yourself with KQL and SPL by building your own detection logic. The more you play around, the better you'll understand how to create effective detections.
✨Tip Number 2
Network like a pro! Connect with other detection engineers and professionals in the field. Join forums, attend webinars, and don’t hesitate to reach out on LinkedIn. You never know who might have the inside scoop on job openings.
✨Tip Number 3
Showcase your skills! Create a portfolio of your detection projects, including examples of how you've reduced false positives. This will not only impress potential employers but also give you confidence during interviews.
✨Tip Number 4
Apply through our website! We love seeing candidates who are genuinely interested in joining us. Tailor your application to highlight your experience with ATT&CK coverage and detection engineering – it’ll make you stand out!
We think you need these skills to ace Senior Detection Engineer - Remote in London
Some tips for your application 🫡
Show Off Your Skills: Make sure to highlight your hands-on experience with detection logic and your expertise in KQL and SPL. We want to see clear examples of how you've reduced false positives and improved signal quality in your previous roles.
Tailor Your Application: Don’t just send a generic application! Take the time to tailor your CV and cover letter to reflect the specific skills and experiences mentioned in the job description. We love seeing candidates who take the extra step to connect their background with what we’re looking for.
Be Clear and Concise: When writing your application, keep it clear and to the point. We appreciate well-structured applications that get straight to the heart of your qualifications and experiences without unnecessary fluff.
Apply Through Our Website: We encourage you to apply directly through our website. It’s the best way for us to receive your application and ensures you’re considered for the role. Plus, it shows us you’re genuinely interested in joining our team!
How to prepare for a job interview at RiverSafe
✨Know Your Detection Logic
Make sure you can confidently discuss your experience with writing detection logic. Be prepared to explain how you've designed, tested, and tuned detections in the past, especially using KQL and SPL. Highlight specific examples where you've reduced false positives or improved signal quality.
✨Familiarise Yourself with MITRE ATT&CK
Since this role involves mapping detections to MITRE ATT&CK, brush up on your knowledge of the framework. Be ready to discuss how you've used it in previous roles to identify coverage gaps and improve detection strategies. Showing that you understand its application will impress the interviewers.
✨Demonstrate Your Hands-On Experience
This isn't just about theory; they want to see your practical skills. Prepare to share clear examples of your hands-on experience in maintaining detections in production environments. Discuss any challenges you've faced and how you overcame them, particularly in relation to threat hunting and incident learnings.
✨Treat Detections as a Product
Emphasise your approach to treating detections as a product rather than one-off alerts. Talk about how you manage the lifecycle of detections, from creation to validation, and how you collaborate with IR and SOC teams. This mindset will show that you’re aligned with their expectations for the role.