Detection Engineer: Build Automated Threat Detections

Keka Inc.; United Arab Emirates; Remote; AED 240,000 - 360,000; Full time

Job summary

CyberGate is seeking an experienced Detection Engineer to build, validate, and continually improve threat detection across managed customer environments. This hands-on role sits at the crossroads of SOC operations, threat intelligence, and security analytics.

You will translate threat intelligence, incidents, and adversary results into testable use cases, map detections to MITRE ATT&CK, and drive automation through CI/CD pipelines in a multi-customer setting.

Qualifications

• 5–8 years of cybersecurity experience with at least 3 years in detection engineering.
• Hands-on with enterprise SIEM platforms such as Sentinel, QRadar, Splunk ES, Elastic SIEM, or similar.
• Advanced query/detection languages: KQL, SPL, SQL, YARA, Sigma; production experience.

Responsibilities

• Design, develop, test, deploy, tune, and maintain detection rules, correlations, and enrichment across SIEM, XDR, EDR, NDR, UEBA, and cloud platforms.
• Own the detection lifecycle from intake to retirement through validation and deployment.
• Translate adversary tactics and threats into testable detection hypotheses and production use cases.
• Map detections to MITRE ATT&CK and data sources; identify gaps and plan coverage improvements.
• Create test suites for positive/negative/regression and conduct controlled simulations.
• Use Git-based workflows and CI/CD for content review, testing, packaging, deployment, rollback, and verification.
• Automate recurring engineering tasks with Python, PowerShell, Bash, REST APIs, or related tooling.
• Define telemetry requirements; coordinate with engineering to improve parsing, enrichment, and data quality.
• Collaborate with SOC analysts to ensure detections include severity, context, guidance, and response recommendations.
• Maintain auditable documentation of requirements, tests, approvals, versions, and outcomes.

Skills

Detection engineering

SIEM content engineering

Threat hunting

Python

REST APIs

Git

CI/CD

Troubleshooting

Documentation

Tools

Microsoft Sentinel

IBM QRadar

Splunk Enterprise Security

Elastic Security

ArcSight

LogRhythm

Stellar Cyber

Job description

CyberGate is seeking an experienced Detection Engineer to build, validate, and continually improve threat detection across managed customer environments. This hands-on role sits at the crossroads of SOC operations, threat intelligence, and security analytics.

You will translate threat intelligence, incidents, and adversary results into testable use cases, map detections to MITRE ATT&CK, and drive automation through CI/CD pipelines in a multi-customer setting.