Lead Cloud Detection & Threat Modelling Engineer in City of London

Lead Cloud Detection & Threat Modelling Engineer – AWS, Azure, Sentinel, Elastic Stack, SOAR platforms
? 6 Month Fixed-Term Contract
? £110k-£120k pro rata
? 100% remote
Build Detection Engineering, Threat Modelling & Security Automation Across Azure and AWS
We're looking for a hands-on Senior Cloud Detection Engineer to help mature and scale our cloud security monitoring, detection and response capabilities across a complex, global, multi-cloud environment.
This role is ideal for someone who has progressed from a Senior SOC Analyst background into Threat Modelling & Detection Engineering and is passionate about threat detection, attack path analysis, automation, and incident response engineering.
Working closely with the CISO, Security Engineering team and SOC partners, you'll own the end-to-end lifecycle of threat detection, from threat modelling and attack simulation through to detection development, automated response orchestration, tuning and continuous improvement.
What You'll Be Doing:
Design, build and optimise detections across both Microsoft Sentinel and Elastic Stack
Develop and maintain advanced detection content using KQL and EQL
Lead end-to-end threat modelling exercises across Azure, AWS , applications, identities, APIs and cloud-native services
Identify attack paths, control gaps and detection opportunities using frameworks such as MITRE ATT&CK
Engineer and automate investigation and response workflows using tools such as Tracecat, Tines, Shuffle or similar SOAR platforms
Build automated playbooks covering triage, containment, enrichment, escalation and response activities
Conduct proactive threat hunting across cloud, endpoint, identity and application telemetry
Collaborate with internal stakeholders and external SOC partners to continuously improve detection coverage
Tune and refine alerting to improve signal quality and reduce false positives
Create and maintain detection engineering documentation, response procedures and operational runbooks
Drive measurable improvements in detection coverage against key attack techniques targeting cloud environments
What We're Looking For:
Previous experience as a SOC Analyst, Senior SOC Analyst, Threat Hunter or Detection Engineer
5+ years' experience within Cyber Security Operations, Detection Engineering or Threat Detection
Strong hands-on experience with both:
Microsoft Sentinel
Elastic Stack (Elasticsearch, Kibana, Elastic Security)
Demonstrable expertise writing and tuning detection content using:
KQL (Kusto Query Language)
EQL (Event Query Language)
Proven experience delivering threat modelling across enterprise cloud platforms
Deep understanding of attacker techniques, detection strategies and defensive security controls
Strong knowledge of AWS security services including CloudTrail, GuardDuty, Security Hub and VPC Flow Logs
Strong knowledge of Azure security monitoring and logging capabilities
Experience building security automation and orchestration workflows using:
Tracecat
Tines
Shuffle
Or equivalent SOAR platforms
Experience creating automated incident response playbooks from initial alert through containment and remediation
Strong understanding of the MITRE ATT&CK framework and cloud attack techniques
Excellent stakeholder management and communication skills
Desirable:
Python or PowerShell scripting experience
Experience working with MDR, MSSP or external SOC providers
Knowledge of detection-as-code methodologies
Relevant certifications such as CISSP, GCIH, GCFA, GIAC, Azure Security Engineer or AWS Security Specialty
Technical Environment:
Keywords: Detection Engineering, Threat Detection, SOC, Sentinel, Elastic Stack, KQL, EQL, Threat Modelling, Azure Security, AWS Security, Incident Response, SOAR, Tines, Tracecat, Threat Hunting, MITRE ATT&CK.
? 6 Month Fixed-Term Contract
? £110k-£120k pro rata
? 100% remote
TPBN1_UKTJ