SOC Detection Engineer

Mars; Guararema; On-site; BRL 120,000 - 200,000; Full time

Benefits offered by this job

Five Principles

Mars University

Company bonus

Job summary

Mars is seeking a SOC Detection Engineer in Guararema, Brazil to advance our SIEM detections across teams and segments. You will create, test, deploy and tune detections, automate investigations, and ensure telemetry supports rapid incident response.

You should have 3+ years in cybersecurity, hands-on SOC experience, and proficiency with SIEM platforms and scripting. Collaboration with incident response and SOAR teams is essential.

Qualifications

• 3+ years of work experience in cybersecurity or related IT areas.
• Hands-on SOC analyst experience.
• Experience with SIEM platforms and security query languages.
• Experience mapping detections to attack lifecycle frameworks (MITRE ATT&CK).
• Knowledge of log sources (EDR, Windows events, identity, cloud and network telemetry).
• Strong scripting and data analytics abilities.

Responsibilities

• Create, deploy and maintain SIEM detection rules aligned with MITRE ATT&CK.
• Validate detections through testing and attack simulation.
• Tune detections to reduce false positives and retire noisy rules.
• Identify gaps in detection coverage and prioritize new use cases.
• Ensure telemetry is complete and suitable for detections.
• Automate detection, enrichment and investigation steps.
• Collaborate with SOC, IR, threat intelligence and SOAR teams.
• Support integrations between SIEM, case management and enrichment platforms.
• Maintain documentation of detection logic and coverage.

Skills

SOC operations

Alert triage

Data analytics

Python

PowerShell

Bash

MITRE ATT&CK

Tools

Git

Job description

Job Description:

SOC Detection Engineer | Guararema, Brazil

Support the Cybersecurity Operations SIEM Detection Engineering capability across teams and business segments. This role is a deep technical subject matter expert who creates, tests, deploys and continuously improves SIEM detections to increase the efficiency and accuracy of incident detection and response. The role tunes existing detections to reduce unnecessary alerts, identifies gaps in detection coverage, validates telemetry for detection use cases and automates detection and investigation steps.

What will be your key responsibilities?

• Create, deploy and maintain SIEM detection rules aligned with MITRE ATT&CK.
• Validate detections through testing and attack simulation before and after deployment.
• Review and tune existing detections using performance metrics to improve true positive rates, reduce false positives and retire noisy or low-value rules.
• Identify gaps in detection coverage across business segments and prioritize new use cases based on threat relevance and risk.
• Ensure security telemetry is complete, accurate and suitable for detection use cases.
• Automate detection, enrichment and investigation steps to reduce manual analyst effort and speed up response.
• Work with SOC operations, incident response, threat intelligence and SOAR teams to turn threat insights and incident lessons learned into actionable detections.
• Support integrations between SIEM, case management and enrichment platforms, working with the SOAR team, so that alerts carry the right context for triage.
• Maintain clear documentation of detection logic, tuning decisions and coverage mapping, and share knowledge with SOC stakeholders.

What are we looking for?

• 3+ years of work experience in cybersecurity or related information technology areas
• Previous hands‑on SOC analyst experience, with a practical understanding of alert triage, investigation workflows and how detection quality affects operations
• Intermediate to advanced experience with SIEM platforms and security query languages
• Experience developing detection use cases, correlating data and mapping detections to attack lifecycle frameworks (e.g., MITRE ATT&CK)
• Knowledge of common security log sources (e.g., EDR, Windows events, identity, cloud and network telemetry)
• Solid data analytics skills, including analyzing large datasets to find patterns, anomalies and tuning opportunities
• Scripting experience (e.g., Python, PowerShell, Bash) and a good grasp of programming logic
• Understanding of offensive security and attacker techniques
• Strong technical writing and communication skills

Nice to have:

• Experience with detection-as-code and version control (e.g., Git)
• Relevant cybersecurity certifications (e.g., SIEM, detection engineering or incident response)
• Understanding of SOAR and security automation concepts

What can you expect from Mars?

• Work with diverse and talented Associates, all guided by the Five Principles.
• Join a purpose driven company, where we’re striving to build the world we want tomorrow, today.
• A strong focus on learning and development support from day one, including access to our in-house Mars University.
• An industry competitive salary and benefits package, including company bonus.