SOC Detection Engineer

The Role

The Senior Detection Engineer is responsible for designing, developing and continuously improving threat-led detection capabilities that identify sophisticated attacker behaviors across the enterprise.
The role translates cyber threat intelligence, threat modelling outputs, red team findings, threat hunting insights and incident learnings into high-fidelity detection logic capable of identifying malicious activity while minimising false positives.
The individual owns the end-to-end lifecycle of detection content, from threat analysis and hypothesis development through to detection design, validation, tuning, optimisation and retirement.

This is a specialist detection engineering role focused on attacker behavior analytics, detection coverage, telemetry strategy and continuous improvement of detection effectiveness. The role is not primarily responsible for day-to-day SIEM administration, platform support or security tooling operations.

Your responsibilities:
1. Design, develop and maintain threat-led detection content aligned to MITRE ATT&CK and organisational threat models.
2. Translate threat intelligence, threat hunting findings, red/purple team outcomes and incident lessons learned into effective detections.
3. Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.
4. Continuously tune and optimise detection logic to improve detection fidelity, reduce false positives and enhance SOC effectiveness.
5. Assess detection coverage, identify telemetry and visibility gaps, and define requirements for improved monitoring and detection.
6. Validate detections through attack simulation, purple teaming and adversary emulation exercises.
7. Maintain detection content documentation, ownership, version control and engineering standards, including Detection-as-Code practices where applicable.
8. Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams to continuously improve detection capabilities.
9. Identify opportunities to automate repetitive SOC analyst activities.
10. Develop automation to support detection testing, validation, reporting and lifecycle management.
11. Design AI enabled hypotheses generate and automated rule creation pipeline.

Your Profile
Essential skills/knowledge/experience:
1. Detection Engineering: Threat-led detection development, behavioral analytics, ATT&CK mapping, detection tuning, validation and lifecycle management.
2. Threat Analysis & Hunting: Threat intelligence, threat modelling, adversary TTP analysis, attack path analysis and threat hunting methodologies.
3. Security Telemetry & Monitoring: Experience working with endpoint, identity, cloud, network, authentication and security telemetry across enterprise environments.
4. Detection Analytics & Automation: Development of detection logic using KQL, SPL, Sigma, Python and PowerShell, including data correlation and Detection-as-Code practices.
5. Security Operations & Incident Response: Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness measurement.
6. Security Domains: Knowledge of Identity & Access Management, Active Directory, Cloud Security, Endpoint Security, Network Security and Email Security.
Desirable skills/knowledge/experience: (As applicable)
1. Bachelor's degree in Cyber Security, Computer Science, Digital Forensics, Information Security or equivalent experience.
2. 8+ years experience in Detection Engineering, Threat Hunting, Security Operations or Threat Research.
3. Demonstrable experience creating behavioural detections for sophisticated adversaries.
4. Experience developing enterprise-scale detections within Microsoft Sentinel, Splunk, Elastic, Chronicle or equivalent SIEM platforms.
5. Experience developing detections using endpoint telemetry from Microsoft Defender, CrowdStrike, SentinelOne or equivalent EDR/XDR platforms.
6. Experience translating threat intelligence and threat modelling outputs into operational detection use cases.
7. Experience supporting purple team exercises and adversary emulation activities.
8. Strong understanding of attacker tradecraft and common attack methodologies.


LA International is an award-winning partner of choice for many of the world's most influential companies and government organisations. Holding Enhanced Government Security Accreditation, we are recognised as the European market leader in the delivery of Security Cleared talent to organisations that demand the very highest levels of security, compliance and assurance.

A multiple award-winning organisation, having secured the prestigious Queens Award for Enterprise: International Trade over consecutive years. We are committed to fostering an inclusive, equitable and accessible workplace where everyone feels valued and supported. We welcome applications from all individuals, regardless of background or identity, and we encourage candidates who may not meet every listed requirement to still apply. If you require any adjustments or support during the recruitment process, please let us know and we will work with you to ensure a fair and accessible experience.

Please Note: If a high volume of applications is received, only candidates shortlisted will be contacted.