> Markdown version of [/jobs/ext/87080-detection-threat-engineer](https://www.wearedevelopers.com/jobs/ext/87080-detection-threat-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Detection & Threat Engineer - **Company:** Checkout.com - **Location:** London, UK - **Contract:** Permanent contract - **Skills:** Software as a Service, Cloud Computing, Cyber Security, Intrusion Detection and Prevention, Python (Programming Language), Network Control, PCI Data Security Standards, Kusto Query Language, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, CIS Benchmarks - **Published:** May 28, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=314db57498d42a2f ## About the Role Do you have experience in SaaS?, * Proven experience in detection engineering, threat hunting, or advanced SOC roles * Deep understanding of modern attacker tradecraft and intrusion techniques across the attack lifecycle * Hands-on experience buidling detection logic in modern SIEM platforms (e.g Sentinel) * Proficienty with scripting and programmaining (e.g. Python, KQL) to build detection pipelines and automation * Willingness to challenge bad detections, weak assumptions, and vanity metrics * Pragmatic mindset: precision and impact beat coverage theatre * Experience operating beyond traditional SOC or MSSP models * Hands-on cloud detection experience (identity, control plane, SaaS) * Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. ## Description You will own and evolve the company's threat detection and threat-hunting capability. This role defines what "good" looks like for detection and increasingly engineers it directly as capability shifts into Cyber Security. This is not an alert-triage role. You are here to understand attacker behaviour, convert it into high-fidelity detection logic, and raise the security baseline for the entire organisation. You will partner closely with Security Operations, GRC and Engineering-setting standards, direction, and expectations-while progressively taking ownership of the most complex and high-value detection and threat engineering work. What you'll be responsible for * Engineering high-fidelity threat detections across endpoint, identity, cloud, and SaaS * Defining detection standards, principles, and quality thresholds for Security Operations * Conducting proactive threat hunting based on attacker behaviour, not vendor alerts * Translating threat intelligence and incident learnings into durable, reusable detections * Mapping detections to MITRE ATT&CK and real-world attack paths * Reducing alert fatigue through logic refinement, correlation, and contextual enrichment * Advising and supporting during high-severity security incidents; contribute to runbooks and escalation playbooks * Driving the transition of advanced detection capability into Cyber Security ownership ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)