About this role
Salary: £? - ? per year
Requirements: Strong hands-on experience in Detection Engineering, Threat Hunting, or Security OperationsPractical knowledge of MITRE ATT&CK, attacker TTPs, and behavioural threat detectionExperience developing detection logic using KQL, SPL, Sigma, or scripting languagesUnderstanding of SIEM, EDR/XDR, security telemetry, and incident investigationAbility to independently design, test, tune, and maintain detection contentDesirable experience with Microsoft Sentinel, Splunk, Elastic, or Google ChronicleDesirable experience with Microsoft Defender, CrowdStrike, or SentinelOneDesirable experience with purple teaming, threat modelling, and Detection-as-Code Responsibilities: Design, develop, and maintain threat detection rules aligned with MITRE ATT&CKBuild behavioural analytics and detection use cases using KQL, SPL, Sigma, Python, and PowerShellDevelop detection content across endpoint, identity, cloud, network, and email security telemetryTune, validate, and optimise detections and reduce false positivesTranslate threat intelligence, incident response findings, and threat hunting insights into actionable detectionsSupport purple teaming, attack simulation, and adversary emulation exercisesIdentify detection coverage gaps and improve security monitoring capabilitiesImplement Detection-as-Code, automation, and detection lifecycle managementCollaborate with SOC, Threat Intelligence, Incident Response, and Red Team specialistsExplore AI-enabled detection hypotheses and automated rule creationOwn the end-to-end detection engineering lifecycle, translating threat intelligence, threat hunting findings, and adversary techniques into effective detection rules Technologies: AICloudSupportNetworkPowerShellPythonSecuritySplunk More:
We are recruiting three experienced Senior SOC Detection Engineers for a six-month contract supporting enterprise cybersecurity operations. This hands-on role focuses on designing, developing, and optimising threat-led detection capabilities across complex environments to identify sophisticated cyber threats, improve security visibility, and support continuous SOC improvement. The role is based in Leamington Spa, Manchester, or Warrington, with a hybrid working pattern of three days onsite and two days remote. We offer competitive market rates.
last updated 42 week of 2026