Detection Engineer

About the role

The Detection Engineer designs, builds, and continuously improves the organization’s threat detection capabilities. This role translates threat intelligence and adversary tactics into high‑fidelity detection logic, conducts proactive threat hunting, and engineers automated detection content across the security stack.

Key responsibilities

• Design, develop, and deploy detection rules and alerts across SIEM, EDR, NDR, and cloud security tools.
• Create high‑fidelity detections using threat intelligence, MITRE ATT&CK techniques, and emerging threats.
• Write detection logic with query and rule languages such as KQL, SPL, Sigma, and YARA.
• Conduct proactive threat‑hunting campaigns to identify coverage gaps and validate hypotheses.
• Test and validate detections using attack simulation tools like Atomic Red Team and CALDERA, and measure coverage against MITRE ATT&CK.
• Onboard new log sources, ensure data quality, and map sources to ATT&CK techniques.
• Develop automation workflows, detection‑as‑code pipelines, and response playbooks.
• Manage detection‑related incidents and changes through ITSM tools such as ServiceNow and Jira.

Required profile

Required skills

• KQL, SPL, Sigma, YARA query languages
• MITRE ATT&CK framework
• SIEM, EDR, NDR, and cloud security platforms
• Atomic Red Team, CALDERA for detection testing
• ServiceNow, Jira for incident and change management
• CI/CD pipelines and detection‑as‑code automation
• Threat‑intelligence feed integration