Detection Engineer — SIEM/EDR for NATO Security Ops

EMW, Inc.; Henegouwen; Sur place; EUR 70 000 - 100 000; Plein temps

Résumé du poste

EMW, Inc. is seeking a Detection Engineer to design, implement, and refine detection rules across SIEM/EDR/NDR and cloud security tools.

You will develop detections aligned with attacker TTPs and MITRE ATT&CK, focusing on NATO-related threats, and collaborate with NCSC, CTIS, and CSIRT to operationalize findings. The role requires hands-on experience in SOC environments, proficiency with Splunk and Microsoft Sentinel, and strong log analysis skills.

Qualifications

• Bachelor's degree in a related field with 3+ years in SOC or equivalent.
• Active NATO SECRET clearance required.
• 3+ years of hands-on SOC or related cyber monitoring experience.
• 3+ years designing and maintaining detections across SIEM/EDR/cloud tools.
• Experience with Splunk, Microsoft Sentinel, and log data analysis.
• Ability to translate attacker tactics into operational detection logic.

Responsabilités

• Design, develop, and maintain detection rules, alerts, and analytics across SIEM, EDR/XDR, NDR, and cloud tools.
• Implement detection logic using Sigma, SPL and KQL.
• Develop detections aligned with MITRE ATT&CK and NATO TTPs.
• Collaborate with NCSC, Threat Hunting Team, and CSIRT on detections.
• Maintain detection lifecycle: design, development, testing, deployment, monitoring, improvement, review.
• Support Detection-as-Code and version control for detection content.
• Review detection quality metrics and perform gap analyses against NATO infrastructure.
• Conduct threat modelling to identify improvement areas for detection capabilities.
• Define priorities for new detections based on NATO surface and intelligence.
• Provide security analysis during incidents.

Connaissances

SOC experience

Detection rule development

MITRE ATT&CK mapping

Threat intelligence

Log analysis

Packet capture analysis

Network security

Threat hunting collaboration

English proficiency

Formation

Bachelor's degree in Cyber Security or related discipline

Outils

Splunk

Microsoft Sentinel

Azure

AWS

Wireshark

tcpdump

Zeek

Suricata

Snort

Kibana

Description du poste

EMW, Inc. is seeking a Detection Engineer to design, implement, and refine detection rules across SIEM/EDR/NDR and cloud security tools.

You will develop detections aligned with attacker TTPs and MITRE ATT&CK, focusing on NATO-related threats, and collaborate with NCSC, CTIS, and CSIRT to operationalize findings. The role requires hands-on experience in SOC environments, proficiency with Splunk and Microsoft Sentinel, and strong log analysis skills.