Your responsibilities:
1. Design, develop and maintain threat-led detection content aligned to MITRE ATT&CK and organisational threat models.
2. Translate threat intelligence, threat hunting findings, red/purple team outcomes and incident lessons learned into effective detections.
3. Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.
4. Continuously tune and optimise detection logic to improve detection fidelity, reduce false positives and enhance SOC effectiveness.
5. Assess detection coverage, identify telemetry and visibility gaps, and define requirements for improved monitoring and detection.
6. Validate detections through attack simulation, purple teaming and adversary emulation exercises.
7. Maintain detection content documentation, ownership, version control and engineering standards, including Detection-as-Code practices where applicable.
8. Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams to continuously improve detection capabilities.
9. Identify opportunities to automate repetitive SOC analyst activities.
10. Develop automation to support detection testing, validation, reporting and lifecycle management.
11. Design AI enabled hypotheses generate and automated rule creation pipeline.
Your Profile
Essential skills/knowledge/experience:
1. Detection Engineering: Threat-led detection development, behavioral analytics, ATT&CK mapping, detection tuning, validation and lifecycle management.
2. Threat Analysis & Hunting: Threat intelligence, threat modelling, adversary TTP analysis, attack path analysis and threat hunting methodologies.
3. Security Telemetry & Monitoring: Experience working with endpoint, identity, cloud, network, authentication and security telemetry across enterprise environments.
4. Detection Analytics & Automation: Development of detection logic using KQL, SPL, Sigma, Python and PowerShell, including data correlation and Detection-as-Code practices.
5. Security Operations & Incident Response: Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness measurement.
6. Security Domains: Knowledge of Identity & Access Management, Active Directory, Cloud Security, Endpoint Security, Network Security and Email Security.
Desirable skills/knowledge/experience:
1. Bachelor's degree in Cyber Security, Computer Science, Digital Forensics, Information Security or equivalent experience.
2. 8+ years experience in Detection Engineering, Threat Hunting, Security Operations or Threat Research.
3. Demonstrable experience creating behavioural detections for sophisticated adversaries.
4. Experience developing enterprise-scale detections within Microsoft Sentinel, Splunk, Elastic, Chronicle or equivalent SIEM platforms.
5. Experience developing detections using endpoint telemetry from Microsoft Defender, CrowdStrike, SentinelOne or equivalent EDR/XDR platforms.
6. Experience translating threat intelligence and threat modelling outputs into operational detection use cases.
7. Experience supporting purple team exercises and adversary emulation activities.
8. Strong understanding of attacker tradecraft and common attack methodologies.
SOC Detection Engineer in Manchester employer: Tcs Uk
As a Provisioning Engineer at our company, you will thrive in a dynamic work culture that prioritises innovation and collaboration. We offer competitive benefits, including professional development opportunities and a supportive environment that encourages growth in the rapidly evolving telecom sector. Located in a vibrant area, our team enjoys a balance of work and life, making it an excellent place for those seeking meaningful and rewarding employment.
