Detection Engineer

Arobas Personnel; Montreal; On-site; CAD 96,000 - 138,000; Full time

Job summary

Arobas Personnel is seeking an experienced Detection Engineer for a contract role in Montréal. You will support a Splunk-based detection environment, working with Incident Response, CTI, SOC and Red Team to strengthen detections and reduce false positives.

Responsibilities include tuning Splunk rules, mapping detections to MITRE ATT&CK, developing new detections, maintaining code in version control, and coordinating with Jira for work items.

Qualifications

• Strong hands-on Splunk experience: SPL, correlation searches, dashboards and data models.
• Proven Detection Engineering experience writing, tuning, and validating SIEM rules.
• Working knowledge of MITRE ATT&CK for threat modeling and coverage mapping.
• Familiarity with security telemetry: EDR, Windows/Linux/Sysmon, network and cloud logs.
• Experience with Threat Hunting methodologies and CTI/I IOCS/TTPs.
• Understanding Incident Response processes and tuning requests to rules.

Responsibilities

• Tune and update Splunk detection rules based on Incident Response requests.
• Design, implement and deploy new Splunk detections aligned with threat patterns.
• Map detections to MITRE ATT&CK and track coverage.
• Maintain detection content under version control and document changes.
• Coordinate with Incident Response, CTI, SOC and Red Team stakeholders.
• Track work items in Jira and ensure timely handoff.

Skills

Splunk

Detection Engineering

MITRE ATT&CK

Threat Hunting

Incident Response

SIEM tuning

Tools

Jira

Git

Python

PowerShell

Job description

Arobas Personnel is looking for an experienced Detection Engineer for a contract opportunity with one of our clients in Montreal.

The Detection Engineer will support the organization’s Splunk-based detection environment, working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections.

Key Responsibilities

• Ensure operational continuity of the Splunk-based detection stack
• Review and implement rule tuning requests from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustments
• Design, develop, and deploy new Splunk detections based on threat patterns, indicators, and TTPs provided by the CTI team
• Map new and existing detections to MITRE ATT&CK to track detection coverage
• Develop and refine detection content for Purple Team exercises, incorporating identified gaps and post-exercise improvements
• Test and validate detection effectiveness before production deployment, including true-positive validation and noise reduction
• Maintain detection logic under version control and document tuning rationale
• Track and manage work items in Jira
• Participate in handoffs and collaboration sessions with Incident Response, CTI, SOC, and Red Team stakeholders

Key Deliverables

• Tuned and updated Splunk detection rules addressing Incident Response requests, with documented rationale
• New detection use cases covering CTI-identified threat patterns, mapped to MITRE ATT&CK
• Detection content supporting Purple Team exercises, including post-exercise improvements
• Up-to-date documentation of detection logic and coverage gaps
• Work items properly tracked and closed in Jira

Must-Have Skills

• Strong hands-on experience with Splunk, including SPL, correlation searches, dashboards, data models, and detection-as-code workflows
• Proven Detection Engineering experience writing, tuning, and validating SIEM detection rules in a production environment
• Working knowledge of MITRE ATT&CK for threat modeling and coverage mapping
• Familiarity with relevant security telemetry and log sources, including EDR, Windows/Linux/Sysmon, network, and cloud logs
• Experience with Threat Hunting methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reporting
• Understanding of Incident Response processes and the ability to translate tuning requests into actionable detection rule changes

Nice To Have

• Exposure to Purple Teaming and adversary emulation, including tools or approaches such as Atomic Red Team and Caldera
• Scripting skills with Python and/or PowerShell for detection logic, automation, and tooling
• Experience with Git for managing detection content as code
• Experience with Jira in an Agile or operational environment
• Ability to clearly document technical decisions and rationale for handoff to technical teams and management

Id

10059

Emplacement

Montréal

Durée De L'emploi

Temps Plein

Nombre D'emplois Vacants

1

Date Limite De Dépôt

Dernière mise à jour

26-11-04 15:21