One click makes a copy of your resume for this role, scores it against the posting, and proposes edits line by line. Your default resume is never changed.
Job match score for this posting
Edits you accept or skip, no invented facts
Download it when it reads right: TXT free, PDF with Premium
Develop, test, tune, and maintain SIEM/EDR detections for priority attacker behaviors and control failures, validating telemetry and documenting logic, evidence, limitations, and analyst response paths. Build and support low-risk security workflows for enrichment, routing, evidence collection, and reporting, collaborating with SOC and incident response teams while escalating critical gaps and unsafe actions.
We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.
Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
Responsibilities
Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.
Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.
Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.
Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.
Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.
Requirements
Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.
Will be a plus
Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.
We offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company's approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)
“I was the first applicant for a remote marketing position that got listed on the company website the same day I applied. Had an interview within 48 hours!”
— Sarah J.
·
Marketing Manager
★★★★★
Verified
