About this role
Salary: £48,000 - 88,000 per year
Requirements
- Active SC clearance
- 1–3 years experience in a SOC Analyst, Security Analyst, Detection Engineer, or Security Operations role
- Strong hands-on experience with Splunk and SPL query development
- Experience building, tuning, and maintaining SIEM detection rules
- AWS security monitoring experience, including CloudTrail, GuardDuty, IAM, and VPC Flow Logs
- Understanding of cyberattack techniques and threat detection methodologies
- Knowledge of incident triage, investigation, and escalation processes
- Experience with Windows, Linux, authentication systems, and endpoint security logs
- Strong communication and stakeholder engagement skills
- Desirable: experience with Cribl; knowledge of OCSF schemas and security data normalisation; familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks; experience with Sigma, YARA, or IDS signature development; exposure to Splunk SOAR, Cortex XSOAR, or other automation platforms; scripting experience in Python, PowerShell, or Bash; experience in UK Government or public sector environments; and Azure or Google Cloud Platform exposure.
Responsibilities
- Develop, test, and optimise Splunk SPL correlation searches and alerting logic
- Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures
- Build AWS-focused detections using CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs
- Tune and enhance detection content to improve alert accuracy and reduce false positives
- Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate
- Map detection coverage against the MITRE ATT&CK framework
- Monitor and triage security alerts in Splunk SIEM
- Investigate incidents, including phishing attacks, credential abuse, malicious process activity, and suspicious network traffic
- Support incident response through containment and escalation procedures
- Maintain detailed security case documentation and investigation notes
- Contribute to operational metrics, including MTTD and MTTR targets
Technologies
- AWS
- Azure
- Bash
- Cloud
- Flow
- IAM
- Support
- Linux
- Network
- PowerShell
- Python
- Security
- Splunk
- Windows
- DevOps
More
We are a leading consultancy recruiting a Detection Engineer for a high-profile cybersecurity programme supporting critical public sector services. The role combines detection engineering and SOC operations, helping protect large-scale cloud environments and strengthen security monitoring across AWS and Splunk. You will work with SOC analysts, engineers, and stakeholders to develop high-fidelity detections, reduce false positives, and improve security visibility. This is a 9-month contract paying £450 per day, outside IR35, based in London with one day per month onsite. We value respect and equality and welcome applicants from all backgrounds and perspectives. We can provide support and reasonable adjustments during the recruitment process.
last updated 43 week of 2026