Security Detection & Response II

Overview

In this role you will strengthen CSOC capabilities by leading end-to-end detection and response activities. You will work within the GIS Monitoring and Triage team to rapidly identify, investigate, and contain threats across domains, leveraging automation and AI-driven approaches to improve security effectiveness. You’ll operate in a follow-the-sun model, shaping detection coverage and incident response with cross-functional collaboration. This position offers impact through reducing MTTR and elevating detection quality in a large, client-focused bank.

Pay / Benefits

• private healthcare for you and family
• annual health screen
• competitive pension plan
• life assurance and income protection
• paid parental leave
• flexible benefits and wellbeing programs

Responsibilities

• Operate the end-to-end detection and response lifecycle (detect, investigate, respond, improve) across multiple data sources to define attack scope and root cause
• Build, validate, tune, and optimize detection logic using MITRE ATT&CK to reduce false positives
• Coordinate security event response activities including containment, isolation, escalation, and remediation
• Maintain and improve automation/orchestration, including SOAR workflows and AI-driven enhancements to cut manual effort
• Document findings with timelines and lessons learned; provide updates to stakeholders and drive continuous improvement
• Identify gaps in monitoring/detection and contribute to operational maturity with metrics and enhancement initiatives
• Support integration of partner use cases into detection and monitoring workflows
• Guide and mentor junior team members toward professional goals

Key requirements

• Experience in security operations, incident response, detection engineering, or related cybersecurity functions in production
• Ability to manage end-to-end investigations across data sources with minimal supervision
• Proficiency in building and tuning detections and response workflows to reduce false positives
• Strong log analysis and data correlation skills; ability to query using KQL, SPL, SQL or similar
• Practical experience with containment, response actions, and SOAR automation
• Experience with SIEM, EDR/XDR, identity security, and cloud security
• Understanding of attacker TTPs and MITRE ATT&CK
• Track record of reducing alert noise and MTTR; strong analytical and communication skills
• Ability to work under pressure and make risk-informed decisions quickly
• Leadership or mentoring experience in a diverse, matrixed environment

• Exceptional communication and executive presence
• Strong problem-solving and critical thinking
• Effective collaboration across organizational levels
• SIEM/EDR/XDR technologies
• SOAR platforms and automation
• Threat detection engineering

…