Detection Engineer

- Relevant qualification(s) in Cyber Security, or other related technical roles - Degree in Cyber Security, Computer Science, Networks, etc. - Professional Qualifications from organizations such as CompTIA, ISACA, etc. - Technical qualifications in security and technology such as (but not limited to) cloud computing, SIEM, Vulnerability Scanning/Management, etc. - Strong experience with Security Information and Event Management (SIEM) tools, particularly Elastic Security (Mandatory) - Hands-on knowledge of Endpoint Detection & Response (EDR) solutions (e.g., Elastic XDR, Microsoft Defender, CrowdStrike, Carbon Black, SentinelOne) - Practical understanding of log sources across network, endpoint, cloud, and identity platforms - Solid knowledge of MITRE ATT&CK framework and application in detection engineering - Proficiency in detection rule development using query languages (e.g., ESQL, KQL, Lucene) - Experience in incident detection, triage, and analysis in SOC or related environments - Understanding of malware techniques, lateral movement, persistence mechanisms, and threat actor TTPs - (Nice to have) Exposure to cloud security monitoring (AWS, Azure, GCP logging and detections) - (Nice to have) Knowledge of SOAR platforms and automation playbook creation - (Nice to have) Experience with YARA, Sigma, or Snort/Suricata rule writing - (Nice to have) Familiarity with container and Kubernetes security monitoring - (Nice to have) Threat intelligence analysis and integrating threat intel into detection workflows - (Nice to have) Knowledge of offensive security/red teaming methodologies to improve detection coverage - (Nice to have) Familiarity with scripting/programming (Python, PowerShell, or similar) for automation and detection enrichment