Detection Engineering Lead - SIEM and Threat Detection

DiceTek UAE; Abu Dhabi; On-site; AED 240,000 - 360,000; Full time

Job summary

Dicetek LLC in Abu Dhabi, United Arab Emirates, is seeking an experienced Detection Engineering Lead to advance enterprise threat detection capabilities in a banking environment. The role combines strategic leadership with hands-on expertise in Microsoft Sentinel and IBM QRadar to translate cyber threat intelligence into actionable detections.

You will mentor security engineers, define detection engineering standards, and collaborate with SOC, threat intelligence, and regulators to improve

Qualifications

• 8+ years in cybersecurity with 4+ years in detection/threat detection or SOC engineering.
• Proven experience leading a detection engineering function in a regulated organisation.
• Expertise in Microsoft Sentinel and IBM QRadar with detection-as-code practices.

Responsibilities

• Lead the design and development of enterprise detection engineering.
• Develop advanced detections using Microsoft Sentinel and QRadar.
• Translate threat intelligence into operational detection use cases.
• Mentor security engineers and promote best engineering practices.
• Communicate detection priorities and effectiveness to executives and auditors.
• Collaborate with SOC, threat intelligence and security stakeholders.

Skills

Detection engineering

Threat detection

SIEM engineering

Cloud & on-prem security

Leadership & mentoring

Education

Bachelor's degree in Computer Science, Information Security or related field

Tools

Microsoft Sentinel

IBM QRadar

Kusto Query Language (KQL)

Ariel Query Language (AQL)

Python/PowerShell

Git CI/CD

Job description

Detection Engineering Lead - SIEM and Threat Detection. Role: Detection Engineering Lead - SIEM and Threat Detection. Location: Abu Dhabi, United Arab Emirates. Industry: Banking. Function: Computer-Network Security. Experience: Minimum 8 years in cybersecurity, including at least 4 years in detection engineering, threat detection or SOC engineering. Job Type: Full Time. Work Arrangement: On-site

Dicetek LLC is seeking an experienced Detection Engineering Lead to support enterprise threat detection capabilities in Abu Dhabi, United Arab Emirates. The role requires a cybersecurity professional with proven experience designing or leading a detection engineering function within a large or regulated organisation. The successful candidate will combine strategic leadership with expert-level technical capabilities in Microsoft Sentinel, IBM QRadar and intelligence-driven detection development. The position focuses on translating cyber threat intelligence into actionable security detections, applying recognised adversary frameworks and establishing effective detection engineering practices. Strong expertise in detection-as-code, security analytics, SIEM engineering and automated detection deployment is essential. The role also requires the ability to communicate detection effectiveness to executives, auditors and regulators while mentoring technical teams and supporting structured decision-making during significant security incidents.

Job Details

• Country: United Arab Emirates
• City: Abu Dhabi
• Industry: Banking
• Function: Computer-Network Security
• Salary: Not disclosed
• Gender: No Preference
• Candidate Nationality: Not specified
• Job Type: Full Time
• Work Arrangement: On-site

Key Responsibilities

• Lead the design and development of an enterprise detection engineering function.
• Establish effective detection engineering practices aligned with organisational cyber risks.
• Provide technical leadership across security detection development and improvement activities.
• Prioritise detection engineering efforts using threat intelligence and business risk considerations.
• Promote consistent engineering standards and technical quality.
• Guide team members in developing and maintaining effective detection capabilities.
• Communicate detection priorities, coverage and limitations to relevant stakeholders.
• Microsoft Sentinel Detection Engineering - Develop advanced threat detections using Microsoft Sentinel.
• Write and optimise Kusto Query Language (KQL) queries.
• Design and maintain Sentinel analytics rules.
• Develop workbooks supporting detection visibility and security analysis.
• Configure and maintain watchlists used in detection scenarios.
• Apply Sentinel automation capabilities to relevant security workflows.
• Troubleshoot detection logic and investigate gaps in monitoring coverage.
• Maintain effective detection content across relevant Microsoft security environments.
• IBM QRadar Detection Engineering - Develop and maintain security detections within IBM QRadar.
• Use Ariel Query Language (AQL) for security event analysis.
• Configure and optimise custom correlation rules.
• Develop and maintain QRadar building blocks.
• Work with Device Support Modules (DSMs) to support relevant event processing requirements.
• Configure and maintain reference sets used in detection logic.
• Investigate detection effectiveness and technical issues affecting QRadar security monitoring.
• Intelligence-Driven Threat Detection - Translate cyber threat intelligence into operational detection use cases.
• Analyse attacker tactics, techniques and procedures to identify relevant detection opportunities.
• Apply MITRE ATT&CK to structure and prioritise threat detection coverage.
• Use MITRE D3FEND concepts to support understanding of defensive countermeasures.
• Apply the Cyber Kill Chain, Diamond Model and Pyramid of Pain when analysing adversary behaviour.
• Consider NIST Cybersecurity Framework principles when aligning detection capabilities with organisational security objectives.
• Maintain a threat-informed approach to detection development and improvement.
• Prioritise security detections according to relevant threat activity and business risk.
• Detection-as-Code and Engineering Automation - Apply detection-as-code practices to security detection development.
• Use Git-based version control for detection content.
• Support CI/CD pipelines for managing detection changes.
• Maintain traceable and controlled detection engineering workflows.
• Develop scripts using Python and/or PowerShell.
• Support repeatable testing and deployment of detection content.
• Promote consistent engineering practices across SIEM detection platforms.
• Cross-Platform Threat Coverage - Develop detection capabilities informed by attacker techniques across Windows environments.
• Apply knowledge of Linux-based threats and security telemetry.
• Address relevant attack techniques affecting Microsoft Azure and Microsoft 365.
• Incorporate identity-related attack scenarios into detection engineering.
• Support detection coverage for network-based threats.
• Consider relationships between endpoint, identity, cloud and network activity when developing detection logic.
• Detection Effectiveness and Reporting - Evaluate detection effectiveness using meaningful engineering and operational metrics.
• Identify detection gaps and opportunities for improvement.
• Use technical evidence and threat intelligence to support detection priorities.
• Prepare clear reporting on detection posture and relevant risks.
• Communicate detection engineering findings to executives, auditors and regulators.
• Support data-driven decisions on detection improvements.
• Maintain appropriate documentation of detection logic and engineering practices.
• Technical Leadership and Mentorship - Mentor security engineers and support the development of detection engineering skills.
• Share technical knowledge and effective engineering practices.
• Encourage analytical thinking and threat-informed detection development.
• Collaborate with SOC, threat intelligence and other cybersecurity stakeholders.
• Provide structured technical leadership during significant security incidents.
• Support effective communication and coordination under operational pressure.

Essential Experience

• Minimum 8 years of professional experience in cybersecurity.
• At least 4 years of experience in detection engineering, threat detection or SOC engineering.
• Proven experience designing or leading a detection engineering function within a large or regulated organisation.
• Expert-level hands‑on experience with Microsoft Sentinel and IBM QRadar.
• Demonstrated ability to convert cyber threat intelligence into operational detections.
• Strong experience applying adversary frameworks and detection engineering principles.
• Experience with detection-as-code, Git-based version control and CI/CD pipelines.
• Strong understanding of attacker tradecraft across Windows, Linux, cloud, identity and network environments.
• Practical scripting experience using Python and/or PowerShell.

Essential Technical Skills

• Microsoft Sentinel
  • Advanced Kusto Query Language.
  • Analytics rule development.
  • Security workbooks.
  • Watchlists.
  • Sentinel automation.
  • Detection content engineering.
  • Security analytics and troubleshooting.
• IBM QRadar
  • Ariel Query Language.
  • Custom correlation rules.
  • QRadar building blocks.
  • Device Support Modules.
  • Reference sets.
  • Threat detection development.
  • SIEM rule engineering.
• Threat Detection Frameworks
  • MITRE ATT&CK.
  • MITRE D3FEND.
  • Cyber Kill Chain.
  • Diamond Model.
  • Pyramid of Pain.
  • NIST Cybersecurity Framework.
• Detection Engineering and Automation
  • Intelligence-driven detection development.
  • Detection-as-code.
  • Git version control.
  • CI/CD pipelines.
  • Python scripting.
  • PowerShell scripting.
  • Detection testing and improvement.
  • Security detection metrics.
• Threat and Technology Domains
  • Windows security threats.
  • Linux security threats.
  • Microsoft Azure.
  • Microsoft 365.
  • Identity-based attacks.
  • Network attack techniques.
  • Enterprise security monitoring.

Highly Desirable Experience

• Banking and Financial Services
  • Experience in banking or financial services.
  • Familiarity with cybersecurity requirements within regulated enterprise environments.
• Advanced Detection Technologies
  • Experience using Sigma detection rules.
  • Knowledge of YARA.
  • Experience with threat intelligence platforms such as MISP, OpenCTI or Recorded Future.
• Adversary-Focused Security Practices
  • Experience in purple teaming.
  • Exposure to adversary emulation.
  • Collaboration with red teams.
  • Background in threat hunting or cyber threat intelligence.
• Security Operations Integration
  • Experience with Microsoft Defender XDR.
  • Familiarity with Endpoint Detection and Response platforms.
  • Experience with Security Orchestration, Automation and Response tooling.

Preferred Professional Certifications

• GIAC Certified Detection Analyst (GCDA).
• GIAC Certified Intrusion Analyst (GCIA).
• GIAC Cyber Threat Intelligence (GCTI).
• GIAC Certified Incident Handler (GCIH).
• GIAC Reverse Engineering Malware (GREM).
• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Relevant IBM QRadar certifications.
• Certified Information Systems Security Professional (CISSP).
• Offensive Security Certified Professional (OSCP).
• Equivalent recognised cybersecurity certifications.

Education

• Bachelor 's degree in Computer Science, Information Security, Engineering or a related field.
• Equivalent professional experience is also acceptable.

Leadership and Professional Competencies

• Strategic Leadership - Ability to establish and develop a detection engineering function.
• Strong understanding of aligning detection priorities with business risk.
• Capability to guide technical strategy and engineering practices.
• Technical Expertise - Expert-level detection development across Microsoft Sentinel and IBM QRadar.
• Strong analytical and troubleshooting capabilities.
• Practical knowledge of adversary behaviour and detection engineering techniques.
• Threat-Informed Decision-Making - Ability to interpret threat intelligence and identify detection priorities.
• Understanding of attacker techniques across enterprise technology environments.
• Evidence-based assessment of detection coverage and effectiveness.
• Stakeholder Communication - Ability to communicate detection posture to senior management.
• Confidence engaging auditors and regulators.
• Clear presentation of technical risks, findings and improvement priorities.
• Mentorship and Team Development - Ability to develop technical talent.
• Commitment to sharing effective engineering practices.
• Strong collaboration across cybersecurity disciplines.
• Analytical Rigour and Incident Leadership - Data-driven decision-making supported by meaningful metrics.
• Structured problem-solving.
• Composure during significant cybersecurity incidents.
• Ability to provide steady technical leadership under pressure.

Role Expectations

The Detection Engineering Lead will combine strategic responsibility for detection engineering capabilities with advanced hands‑on expertise in Microsoft Sentinel and IBM QRadar. The successful candidate will apply cyber threat intelligence, adversary frameworks and detection‑as‑code practices to strengthen enterprise threat detection. The role requires an experienced cybersecurity professional who can guide engineering teams, prioritise detection improvements according to organisational risk and communicate detection effectiveness to senior stakeholders. The central objective is to establish and maintain a threat‑informed detection engineering capability that supports effective security monitoring across enterprise technology environments.