About this role
Salary: £120,000 - 120,000 per year
Requirements
- We are looking for someone with prior experience as a SOC Analyst, Senior SOC Analyst, Threat Hunter, or Detection Engineer.
- We require at least 5 years of experience in Cyber Security Operations, Detection Engineering, or Threat Detection.
- We require strong hands-on experience with Microsoft Sentinel and Elastic Stack, including Elasticsearch, Kibana, and Elastic Security.
- We require demonstrated expertise writing and tuning detection content using KQL and EQL.
- We require proven experience delivering threat modelling across enterprise cloud platforms.
- We require a deep understanding of attacker techniques, detection strategies, and defensive security controls.
- We require strong knowledge of AWS security services, including CloudTrail, GuardDuty, Security Hub, and VPC Flow Logs.
- We require strong knowledge of Azure security monitoring and logging capabilities.
- We require experience building security automation and orchestration workflows using Tracecat, Tines, Shuffle, or equivalent SOAR platforms.
- We require experience creating automated incident response playbooks from initial alert through containment and remediation.
- We require a strong understanding of the MITRE ATT&CK framework and cloud attack techniques.
- We value excellent stakeholder management and communication skills.
- Python or PowerShell scripting experience is desirable.
- Experience working with MDR, MSSP, or external SOC providers is desirable.
- Knowledge of detection-as-code methodologies is desirable.
- Relevant certifications such as CISSP, GCIH, GCFA, GIAC, Azure Security Engineer, or AWS Security Specialty are desirable.
Responsibilities
- We need our engineer to design, build, and optimise detections across Microsoft Sentinel and Elastic Stack.
- We need our engineer to develop and maintain advanced detection content using KQL and EQL.
- We need our engineer to lead end-to-end threat modelling across Azure, AWS, applications, identities, APIs, and cloud-native services.
- We need our engineer to identify attack paths, control gaps, and detection opportunities using frameworks such as MITRE ATT&CK.
- We need our engineer to build and automate investigation and response workflows using SOAR platforms such as Tracecat, Tines, or Shuffle.
- We need our engineer to create automated playbooks for triage, containment, enrichment, escalation, and response.
- We need our engineer to conduct proactive threat hunting across cloud, endpoint, identity, and application telemetry.
- We need our engineer to collaborate with internal stakeholders and external SOC partners to improve detection coverage.
- We need our engineer to tune and refine alerting to improve signal quality and reduce false positives.
- We need our engineer to create and maintain detection engineering documentation, response procedures, and operational runbooks.
- We need our engineer to drive measurable improvements in detection coverage against key attack techniques targeting cloud environments.
Technologies
- AWS
- Azure
- Cloud
- ElasticSearch
- Flow
- Kibana
- PowerShell
- Python
- Security
- DevOps
More
We are seeking a hands-on Senior Cloud Detection Engineer to mature and scale our cloud security monitoring, detection, and response capabilities in a complex, global, multi-cloud environment. The role works closely with our CISO, Security Engineering team, and SOC partners, and is suited to someone with a senior SOC background who is passionate about threat detection, attack path analysis, automation, and incident response engineering. Our technical environment includes AWS, Azure, Microsoft Sentinel, Elastic Stack, and SOAR platforms. This is a 6-month fixed-term contract, paying £110,000–£120,000 pro rata, and is 100% remote.
last updated 43 week of 2026