Senior Detection Engineer in banking domain

TAT IT Technolgies; Abu Dhabi; Sur place; AED 180 000 - 240 000; Plein temps

Résumé du poste

TAT IT Technolgies in Abu Dhabi, UAE, is hiring a Senior Detection Engineer to lead intelligence-driven threat detections across Microsoft Sentinel and IBM QRadar. The role combines strategic leadership with hands-on engineering to ensure detections reflect threat profiles, regulatory obligations and business risk.

You will mentor and develop the detection team, drive detection-as-code governance, and collaborate with CTI, incident response, threat hunting and risk functions to continuously

Qualifications

• 8+ years in cyber security with at least 4 years in detection/SOC roles.
• Proven leadership in detection engineering within regulated environments.
• Expert in deploying and tuning Microsoft Sentinel and IBM QRadar.
• Strong knowledge of MITRE ATT&CK, D3FEND, NIST CSF, and PCI DSS.

Responsabilités

• Lead detection engineering strategy, governance and roadmap.
• Convert CTI/threat hunting/IR findings into durable detections.
• Align detections with MITRE, Cyber Kill Chain and ISO/PCI standards.
• Mentor engineers, report to senior management, and drive CI/CD-based detection content.

Formation

Bachelor's degree in Computer Science/Information Security

Outils

Microsoft Sentinel

IBM QRadar

KQL

AQL

Description du poste

We have an urgent requirement for Senior Detection Engineer in banking domain (Must) is required for our banking clients in Abu Dhabi ,UAE

Establish and lead the detection engineering practice, including strategy, governance, detection-as-code processes, quality standards, team mentoring, and stakeholder reporting.--

Must

Develop and enhance intelligence-led threat detections by converting CTI, threat hunting, and incident response findings into actionable security detections aligned with emerging threats--

Must

Design, build, tune, and maintain advanced detections in Microsoft Sentinel (KQL) and IBM QRadar (AQL), leveraging behavioral analytics, Sigma, SOAR integrations, and CI/CD-based detection management.-

-Must

Measure and improve detection coverage using MITRE ATT&CK, D3FEND, NIST CSF, Cyber Kill Chain, conduct adversary emulation/purple team testing, and optimize detection performance through continuous tuning and metrics analysis.--

Must

Banking Domain --

Must

Role Overview

We're hiring a Senior Detection Engineer to set up, lead and develop our detection engineering function. You'll own the strategy, design and delivery of intelligence-driven threat detection across IBM QRadar and Microsoft Sentinel. The aim is for detection coverage to reflect the organisation's threat profile, business risks and regulatory obligations.

This is both a leadership and a hands-on technical role. You'll set the standards for how detections are built, tested, deployed, measured and retired. You'll also work closely with cyber threat intelligence, incident response, threat hunting, red team and risk functions so detection capability keeps pace with emerging threats.

Key Responsibilities

Function Leadership and Design

• Design and set up the detection engineering function, including its operating model, roles, processes, governance and roadmap.
• Define and run a detection-as-code lifecycle covering requirements, development, peer review, testing, deployment, tuning and retirement.
• Set detection standards, naming conventions, documentation requirements and quality controls.
• Lead, mentor and develop detection engineers and analysts, building capability and a strong engineering culture.
• Present detection strategy, coverage and risk position to senior management, risk committees and auditors.

Intelligence-Driven Detection

• Turn cyber threat intelligence (CTI) into prioritised, actionable detection requirements based on the threats most relevant to the organisation.
• Model threat actors and attack campaigns, including ransomware groups, financially motivated actors, APTs, fraud and insider threats.
• Work with CTI, threat hunting and incident response teams to close the loop: turn hunt findings, incident lessons and intelligence reports into durable detections.
• Use industry and sector intelligence sources such as ISACs, vendor reporting and government advisories to shape detection priorities.

Framework Alignment and Coverage

• Map and measure detection coverage against MITRE ATT&CK and apply MITRE D3FEND, the Cyber Kill Chain, the Pyramid of Pain and the Diamond Model to shape detection design.
• Align detection capability with the NIST Cybersecurity Framework, ISO 27001, PCI DSS and other relevant regulatory and industry standards.
• Run threat-informed coverage assessments, identify gaps and prioritise the roadmap by risk.
• Apply detection maturity models (e.g., the Detection Maturity Level model) and report progress over time.

Detection Development (Sentinel and QRadar)

• Design, build and tune advanced detections in Microsoft Sentinel (KQL) and IBM QRadar (AQL, rules, building blocks, reference data).
• Develop behavioural, anomaly-based and correlation detections, not just indicator-based rules.
• Use vendor-neutral formats such as Sigma and manage detection content in version control with CI/CD pipelines.
• Integrate detections with SOAR playbooks so response is automated and consistent.
• Support SIEM platform strategy, including any coexistence or migration between QRadar and Sentinel.

Validation, Testing and Metrics

• Validate detections continuously through adversary emulation, purple teaming and breach and attack simulation tools (e.g., Atomic Red Team, MITRE Caldera).
• Track and report detection performance metrics, including coverage, true/false positive rates, mean time to detect (MTTD), alert fidelity and analyst workload.
• Keep tuning detections to reduce noise and increase SOC efficiency.

Governance and Assurance

• Keep detection documentation, rationale and evidence ready for internal and external audit.
• Make sure critical log sources are onboarded, monitored and complete enough to support detection objectives.
• Contribute to incident post-mortems and make sure lessons learned become detection improvements.

Essential Requirements

• 8+ years' experience in cyber security, with at least 4 years in detection engineering, threat detection or SOC engineering roles.
• Proven experience designing or leading a detection engineering function in a large or regulated organisation.
• Expert-level hands‑on experience with Microsoft Sentinel (KQL, analytics rules, workbooks, watchlists, automation) and IBM QRadar (AQL, custom rules, building blocks, DSMs, reference sets).
• Proven track record of intelligence-driven detection development, turning CTI into operational detections.
• In-depth knowledge of MITRE ATT&CK, D3FEND, Cyber Kill Chain, Diamond Model, Pyramid of Pain and NIST CSF.
• Experience with detection-as-code, Git-based version control and CI/CD pipelines.
• Strong understanding of attacker tradecraft across Windows, Linux, cloud (Azure/M365), identity and network environments.
• Scripting skills in Python and/or PowerShell.

Highly Desirable

• Banking or financial services experience.
• Experience with Sigma, YARA and threat intelligence platforms (e.g., MISP, OpenCTI, Recorded Future).
• Experience in purple teaming, adversary emulation or red team collaboration.
• Experience with Microsoft Defender XDR, EDR platforms and SOAR tooling.
• Background in threat hunting or cyber threat intelligence.

Certifications (Preferred)

• GIAC certifications such as GCDA, GCIA, GCTI, GCIH or GREM
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• IBM QRadar certifications
• CISSP, OSCP or equivalent

Key Competencies

• Strategic leadership: able to build a function from the ground up and align it with business risk.
• Technical depth: expert-level detection development across Sentinel and QRadar.
• Threat-informed mindset: thinks like an adversary and prioritises based on intelligence.
• Stakeholder management: communicates detection posture clearly to executives, auditors and regulators.
• Mentorship: develops talent and spreads good engineering practice across the team.
• Analytical rigour: makes data-driven decisions supported by meaningful metrics.
• Composure under pressure: offers steady, structured leadership during significant incidents.

Education

Bachelor's degree in Computer Science, Information Security, Engineering or a related field, or equivalent professional experience.

Skills: intelligence,bank,detection