Cyber Detection Engineering Lead

• Degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical experience. \n
• Proven track record in developing use cases and detection logic within a Security Operations Center (SOC) environment, including leadership or mentorship experience. \n
• Strong proficiency in Python and hands-on experience with automation frameworks to streamline operations. \n
• Deep technical expertise in Windows and Linux operating systems, including OS internals, system logging, and telemetry analysis. \n
• Practical background in Red Teaming, Penetration Testing, or an offensive mindset to anticipate attacker methodologies. \n
• Advanced expertise with the MITRE ATT&CK® framework and Detection-as-Code concepts. \n
• Strong communication skills with an empathetic, collaborative approach to leading cross-functional teams and technical initiatives. \n

• Fair Compensation & Extras: Attractive remuneration and individual additional benefits, such as company pension schemes, mobility offers (e.g., bike leasing), or corporate discounts with partner companies in accordance with our current guidelines. \n
• Time for You (and Your Loved Ones): 30 days of annual leave based on our collective agreement (35-hour week); work-life balance through flexible working hours (flextime), mobile working, part-time options, job sharing, and sabbatical opportunities. \n
• Growth Made Easy: Excellent professional development opportunities and international, group-wide career perspectives. \n
• Feel Good at Work: On-site company doctor; comprehensive health programs (sports courses, preventive care, etc.), canteen and cafeteria, and local childcare facilities at selected locations. \n
• Diversity Connects: Work in a diverse environment with more than 140 nationalities, where exchange, mutual support, and inclusion are part of our DNA. \n

\n

Your tasks and responsibilities \n \n

• Lead Detection Strategy: Define the long-term vision for detection engineering, aligning technical roadmaps with organizational risk profiles while standardizing the development lifecycle. \n
• Engine & Rule Lifecycle Management: Architect, develop, maintain, and optimize high-fidelity detection rules for the SOC while expanding framework coverage against MITRE ATT&CK® and Sigma standards. \n
• Threat Intelligence Translation: Analyze Cyber Threat Intelligence (CTI) and translate complex TTPs into proactive, resilient detection logic. \n
• Automation & Orchestration: Drive "Detection-as-Code" initiatives and engineer automated response playbooks to streamline incident response and minimize manual intervention. \n
• Technical Mentorship & Escalation: Act as the primary escalation point for complex technical issues, mentoring junior detection engineers and SOC analysts. \n
• Cross-Functional Collaboration: Partner closely with Incident Response and SOC teams to ensure deployment of context-rich detections that enable rapid threat containment. \n

\n