Detection Engineer

Cyber Gate Defense; United Arab Emirates; On-site; AED 250,000 - 380,000; Full time

Job summary

Cyber Gate Defense is seeking a senior Detection Engineer to own design, development, and maintenance of detections across SIEM, XDR, EDR, and cloud platforms in the UAE. You will translate threat intel and incidents into production use cases, map detections to MITRE ATT&CK, and drive validation, testing, and deployment with CI/CD pipelines.

You will collaborate with SOC analysts, write Python scripts, and develop robust telemetry and data quality improvements while contributing to automated

Qualifications

• Experience in detection engineering and SIEM content development.
• Ability to translate threat intel and incidents into production detections.
• Strong knowledge of MITRE ATT&CK and threat hunting.
• Proficiency in Python and REST APIs; familiarity with Git and CI/CD.

Responsibilities

• Design, develop, test, deploy, tune, and maintain detection rules across SIEM/XDR/EDR/UEBA platforms.
• Own the detection lifecycle from intake to retirement, including validation and deployment.
• Translate adversary activities into testable detection hypotheses and use cases.
• Map detections to MITRE ATT&CK and data sources; plan coverage improvements.
• Create tests and run purple-team exercises; automate with scripting and APIs.
• Contribute to CI/CD workflows and content review, testing, and deployment.

Skills

Detection engineering

SIEM content engineering

Threat hunting

SOC engineering

Python

REST APIs

Git

CI/CD

KQL

SPL

AQL

SQL

EQL

Lucene

YARA

Sigma

MITRE ATTACK

Tools

Microsoft Sentinel

IBM QRadar

Splunk Enterprise Security

Stellar Cyber

Elastic Security

ArcSight

LogRhythm

Job description

• Design, develop, test, deploy, tune, and maintain detection rules, correlation logic, behavioral analytics, risk-based detections, queries, and enrichment across SIEM, XDR, EDR, NDR, UEBA, and cloud-native security platforms.
• Own the detection lifecycle from intake and prioritization through design, peer review, validation, approval, deployment, monitoring, tuning, periodic review, and retirement.
• Translate adversary tactics, techniques, and procedures, threat intelligence, VAPT findings, incidents, and threat-hunting outcomes into testable detection hypotheses and production use cases.
• Map detections to MITRE ATT&CK and relevant data sources; identify blind spots and develop prioritized, evidence-based coverage improvement plans.
• Create positive, negative, regression, and performance tests, using representative data, controlled attack simulation, purple-team exercises, and adversary emulation where appropriate.
• Use Git-based workflows and contribute to CI/CD pipelines for content review, testing, packaging, deployment, rollback, and post-deployment verification.
• Automate repetitive engineering activities using Python, PowerShell, Bash, REST APIs, platform SDKs, SOAR, or orchestration capabilities.
• Define telemetry requirements and work with engineering teams to improve parsing, normalization, enrichment, retention, latency, and data quality.
• Partner with SOC analysts to ensure detections include clear severity, triage context, investigation guidance, known limitations, and response recommendations.
• Maintain auditable documentation covering requirements, test evidence, approvals, versions, tuning decisions, dependencies, and outcomes. Role & responsibilities

Preferred candidate profile

• 58 years of relevant cybersecurity experience, including at least 3 years in detection engineering, SIEM content engineering, security analytics, threat hunting, SOC engineering, or a closely related discipline.
• Strong hands-on experience with one or more enterprise SIEM platforms such as Microsoft Sentinel, IBM QRadar, Splunk Enterprise Security, Stellar Cyber, Elastic Security, ArcSight, or LogRhythm.
• Advanced capability in relevant query or detection languages such as KQL, SPL, AQL, SQL, EQL, Lucene, YARA, or Sigma, with deep practical experience in at least one production ecosystem.
• Strong understanding of MITRE ATT&CK, attacker tradecraft, threat detection, log analysis, detection limitations, rule tuning, and evidence-based validation.
• Experience with security telemetry from endpoint, network, identity, email, firewall, DNS, proxy, WAF, cloud control plane, SaaS, and vulnerability platforms.
• Working proficiency in Python and REST APIs, plus experience with Git, code review, structured testing, JSON/YAML, and CI/CD concepts.
• Ability to troubleshoot complex cross-platform issues and clearly explain technical decisions to both technical and non-technical stakeholders.
• Strong documentation, collaboration, prioritization, and evidence-management skills in a multi-customer environment.