Detection Engineer — SIEM Rule Author & Threat Telemetry

Jobtailor; Sydney; On-site; AUD 110,000 - 170,000; Full time

Job summary

Jobtailor in Sydney, Australia is seeking a Detection Engineer to own detections across Microsoft Sentinel, SentinelOne and Splunk. You will translate threat intelligence into telemetry detections aligned with MITRE ATT&CK and map logging coverage to business risk.

You will write efficient queries, reduce false positives, document complex technical details for both technical and non-technical audiences, and mentor junior team members while coordinating with threat hunters and SOC analysts

Qualifications

• At least 2 years of hands-on experience in detection engineering or a large-scale security operations practice.

Responsibilities

• Own detection content across Microsoft Sentinel, SentinelOne and Splunk.

Skills

Detection Rule Authoring

False Positive Reduction

Event Analysis

Data Querying

Incident Triage

Education

Computer science degree (certificate/diploma/bachelor/master)

SC-200

Blue Team Level 1

Blue Team Level 2

SANS Incident Responder

GIAC GCDA

Tools

SentinelOne

SIEM

Telemetry Detections

Job description

Jobtailor in Sydney, Australia is seeking a Detection Engineer to own detections across Microsoft Sentinel, SentinelOne and Splunk. You will translate threat intelligence into telemetry detections aligned with MITRE ATT&CK and map logging coverage to business risk.

You will write efficient queries, reduce false positives, document complex technical details for both technical and non-technical audiences, and mentor junior team members while coordinating with threat hunters and SOC analysts