Location: Leamington Spa, Manchester or Warrington
Working Pattern: Hybrid – 3 days onsite, 2 days remote
Contract: 6 months
Rate: Competitive market rates
Vacancies: 3
The Opportunity
We are recruiting experienced Senior SOC Detection Engineers for a six-month contract supporting enterprise cyber security operations. This hands‑on role focuses on designing, developing and optimising threat‑led detection capabilities to identify sophisticated cyber threats across complex environments.
You will own the end-to-end detection engineering lifecycle, translating threat intelligence, threat hunting findings and adversary techniques into effective detection rules that improve security visibility and reduce false positives.
Key Responsibilities
Design, develop and maintain threat detection rules aligned with MIT&CK.
- Build behavioural analytics and detection use cases using KQL, SPL, Sigma, Python and PowerShell.
- Develop detection content across endpoint, identity, cloud, network and email security telemetry.
- Perform detection tuning, validation, optimisation and false‑positive reduction.
- Translate threat intelligence, incident response findings and threat hunting insights into actionable detections.
- Support purple teaming, attack simulation and adversary emulation exercises.
- Identify detection coverage gaps and improve security monitoring capabilities.
- Implement Detection-as-Code, automation and detection lifecycle management.
- Collaborate with SOC, Threat Intelligence, Incident Response and Red Team specialists.
- Explore AI‑enabled detection hypotheses and automated rule creation.
Essential Skills and Experience
- Strong hands‑on experience in Detection Engineering, Threat Hunting or Security Operations.
- Practical knowledge of MIT&CK, attacker TTPs and behavioural threat detection.
- Experience developing detection logic using KQL, SPL, Sigma or scripting languages.
- Understanding of SIEM, EDR/XDR, security telemetry and incident investigation.
- Ability to independently design, test, tune and maintain detection content.
Desirable Experience
- Microsoft Sentinel, Splunk, Elastic or Google Chronicle.
- Microsoft Defender, CrowdStrike or SentinelOne.
- Purple teaming, threat modelling and Detection-as-Code.
#J-18808-Ljbffr…