Senior Detection Engineer

Role Overview

We are seeking an experienced Senior Detection Engineer to lead the design, development, and maturity of enterprise threat detection capabilities within a sophisticated cyber security environment.

This role will be responsible for establishing and driving a threat-informed detection engineering program that aligns with organizational risks, intelligence requirements, and regulatory obligations. The successful candidate will play a critical role in developing advanced detection content, improving security monitoring effectiveness, and enabling proactive identification of emerging threats.

The ideal candidate will possess deep expertise in Detection Engineering, Threat Detection, Microsoft Sentinel, IBM QRadar, Threat Intelligence, MITRE ATT&CK, and Security Monitoring, with the ability to combine strategic leadership and hands-on technical delivery. 

Key Responsibilities

Detection Engineering Leadership

• Establish and develop a mature detection engineering function, operating model, and capability roadmap.
• Define standards, development processes, governance controls, and quality frameworks for detection content.
• Lead and mentor detection engineers and security analysts.
• Present detection strategies, risk-based recommendations, and coverage assessments to senior stakeholders.

Intelligence-Driven Detection

• Transform threat intelligence into prioritized detection requirements.
• Develop detections aligned with current threat actors, attack campaigns, insider threats, and emerging risks.
• Collaborate closely with Threat Intelligence, Threat Hunting, Red Team, and Incident Response teams.
• Ensure intelligence findings are translated into operational detection capabilities.

Threat Detection Development

• Design, develop, and optimize advanced detections leveraging:

  • Microsoft Sentinel
  • IBM QRadar
  • KQL
  • AQL

• Build behavior-based, anomaly-based, and correlation detections.

• Develop Detection-as-Code capabilities supported through version control and CI/CD pipelines.

• Integrate detection content with automated response workflows and SOAR capabilities.

Threat Coverage & Validation

• Map detection coverage against:

  • MITRE ATT&CK
  • MITRE D3FEND
  • Cyber Kill Chain
  • Diamond Model
  • Pyramid of Pain

• Identify detection gaps and prioritize improvements based on risk.

• Validate detections through purple teaming, adversary emulation, and attack simulation exercises.

• Continuously improve coverage, fidelity, and response effectiveness.

Governance & Performance Management

• Define and report detection performance metrics including:

  • Detection Coverage
  • Alert Fidelity
  • False Positive Rates
  • Mean Time to Detect (MTTD)

• Maintain audit-ready documentation and evidence supporting detection controls.

• Support regulatory, compliance, and audit requirements.

• Ensure critical log sources support organizational detection objectives.

Required Skills & Qualifications

• 8+ years of cybersecurity experience with at least 4 years focused on Detection Engineering or Threat Detection.

• Proven experience building or leading enterprise detection engineering functions.

• Expert knowledge of:

  • Microsoft Sentinel
  • IBM QRadar
  • Threat Detection Engineering
  • Security Monitoring
  • Threat Intelligence Integration

• Strong expertise with:

  • KQL
  • AQL
  • Detection-as-Code
  • Git Repositories
  • CI/CD Pipelines

• Deep understanding of:

  • MITRE ATT&CK
  • MITRE D3FEND
  • NIST Cybersecurity Framework (CSF)
  • Cyber Kill Chain
  • Pyramid of Pain
  • Diamond Model

• Experience developing advanced detections across:

  • Windows
  • Linux
  • Azure
  • Microsoft 365
  • Identity Services
  • Network Security Platforms

• Strong scripting capabilities in:

  • Python
  • PowerShell

• Excellent communication, leadership, and problem-solving skills.

Preferred Skills & Experience

• Banking and financial services industry experience.

• Experience with:

  • Sigma
  • YARA
  • MISP
  • OpenCTI
  • Recorded Future

• Exposure to Red Teaming, Purple Teaming, and Adversary Emulation.

• Experience with Microsoft Defender XDR and advanced EDR platforms.

• Background in Threat Hunting or Cyber Threat Intelligence.

• Experience working within highly regulated enterprise environments.

Certifications

Preferred

• GIAC GCDA
• GIAC GCIA
• GIAC GCTI
• GIAC GCIH
• GIAC GREM
• Microsoft SC-200
• IBM QRadar Certifications
• CISSP
• OSCP

Education & Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline.
• Relevant cybersecurity, threat detection, and security engineering certifications are highly desirable.

Halian Group

With over 28 years of experience, we have come to understand that innovation is the only way to provide agile, practical solutions that transform businesses and careers. Our resourcing and smart services help you to realise tomorrow's potential. Discover the amazing things possible when you bring the right people and the right technologies together.

At Halian, we recognise that diversity, equity, and inclusion (DEI) are essential to building high-performing teams for our clients. We are committed to connecting organisations with top talent from all backgrounds, ensuring that every individual feels valued, respected, and empowered to contribute their unique perspectives.

We encourage applications from all qualified candidates, regardless of race, gender, disability, or any other characteristic that makes them unique.

#LI-CC1