Threat Detection Engineer – L2

About the role

As a Threat Detection Engineer at COGNNA you will design high‑impact detection strategies, build automation, and elevate SOC operations to a world‑class standard. You will also mentor emerging cyber talent and work closely with threat intel, incident response, and platform engineering teams.

Key responsibilities

• Develop high‑fidelity correlation rules and behavioral detections across COGNNA security platforms.
• Translate MITRE ATT&CK tactics, threat intel, and vulnerability data into actionable detection logic.
• Identify detection gaps, add new data sources, and automate detection testing to maintain quality.
• Lead architecture and optimisation of XDR, SIEM and SOC tech stacks for scale and resilience.
• Streamline log ingestion pipelines, from parsing to enrichment, and build scripts (Python, PowerShell) to improve SOC efficiency.
• Integrate tools across the SOC stack to enable seamless workflows and response.
• Collaborate with intel and IR teams to enrich use cases, support threat hunts and provide Tier‑3+ incident investigation support.
• Improve SOC playbooks, SOPs and detection engineering workflows while ensuring compliance with relevant standards.

Required profile

• Bachelor’s degree in Computer Science, Cybersecurity or a related field.
• Minimum 3 years of hands‑on experience developing and maintaining complex detection use cases.
• Strong understanding of attacker behaviour, incident response fundamentals and digital forensics.
• Excellent analytical thinking, communication in English (and Arabic) and mentorship abilities.

Required skills

• Python
• PowerShell
• SIEM query languages (SPL, KQL, Lucene)
• UEBA and rule tuning
• EDR platforms
• Packet analysis with Wireshark
• IDS/IPS and NetFlow
• Windows, Linux and macOS logging and forensic artefacts
• XDR and SOC technology stack optimisation
• Cloud security monitoring for IaaS/PaaS/SaaS environments
• MITRE ATT&CK framework

What we offer

• Impact that matters – build products shaping the future of cybersecurity.
• On‑site collaboration at COGNNA’s headquarters.