Detection Engineer - Cyber Security

We are seeking an experienced Detection Engineer/Content Developer with strong SIEM content development and migration expertise., * Develop, modify and optimise detection content across SIEM platforms.

• Analyse existing detection logic and translate correlation rules between SIEM technologies, particularly ArcSight and Google SecOps.
• Create new detection rules from scratch based on security requirements and threat scenarios.
• Validate migrated and newly developed detections to ensure equivalent coverage, accuracy and performance.
• Work with security teams to improve detection capabilities and reduce gaps in coverage.
• Strong hands-on detection engineering and content development experience.
• Proven experience migrating detection content between SIEM platforms.
• Ability to understand detection intent and translate rules while accounting for differences in data models, fields, syntax and platform capabilities.
• Experience developing and validating detection rules from scratch.
• Strong knowledge of security monitoring, threat detection and SIEM technologies.

Desirable:

• Google SecOps (Chronicle) experience.
• ArcSight experience.
• Experience with multiple SIEM platforms such as Splunk, Microsoft Sentinel, QRadar or Elastic.

This role is focused on detection engineering and SIEM content development. Candidates with primarily SIEM administration, operational monitoring or platform support experience are unlikely to be suitable. We are specifically looking for individuals who can design, migrate, test and optimise detection content.