Purple Team Engineer: Threat Emulation & Detection

Neotalent Conclusion; Madrid; Hybride; EUR 75 000 - 115 000; Plein temps

Avantages offerts par ce poste

Hybrid working model in Madrid

Private health insurance

Meal vouchers

Transportation allowance

Training and certifications

Childcare support

Global Security Operations Center role

Résumé du poste

Neotalent Conclusion in Madrid is seeking a Purple Team Specialist to join our cybersecurity team, working with a leading global insurance client in an international environment. You will lead adversary emulation, threat hunting, and detection engineering efforts within MITRE ATT&CK-aligned workflows.

The role requires 3–7 years in security, hands-on Red/ Purple Team experience, and strong skills in KQL, SIEM, and cloud security.

Qualifications

• University degree in Information Security, Computer Science, or Engineering.
• Between 3 and 7 years of professional experience in cybersecurity environments.
• At least 3 years of hands-on experience in offensive security, adversary emulation, detection engineering, threat hunting, incident response, or related disciplines.
• At least 3 years of practical Red Team and/or Purple Team experience in enterprise environments.
• Strong expertise in Detection Engineering (mandatory and key requirement).
• Proven experience transforming test results into improved detections, telemetry, investigation processes, response playbooks, and remediation actions.
• Deep understanding of MITRE ATT&CK and threat-informed defense methodologies.
• Experience with enterprise SOC technologies, including SIEM, EDR/XDR, SOAR, network security monitoring, email security, identity telemetry, and cloud security logging solutions.
• Strong expertise with Microsoft Sentinel.
• Strong expertise with Microsoft Defender XDR.
• Hands-on experience writing and optimizing KQL queries.
• Knowledge of Windows, Linux, Active Directory, Microsoft Entra ID, Microsoft 365, cloud, and network attack paths and post-exploitation techniques.
• Experience developing automation using Python, PowerShell, Bash, APIs, version control systems, and CI/CD environments.
• Excellent English communication skills. Spanish is a plus.

Responsabilités

• Plan and execute threat-led security validation exercises based on threat intelligence, recent incidents, business risks, and detection gaps.
• Design and perform adversary emulation campaigns across endpoint, identity, email, network, and cloud environments.
• Map attack activities to the MITRE ATT&CK framework and assess security control effectiveness.
• Partner with Detection Engineering and Threat Hunting teams to validate telemetry and improve detection coverage.
• Create, tune, and optimize analytics, correlation rules, and behavioral detections.
• Validate and improve KQL queries, reducing blind spots and false negatives.
• Assess end-to-end SOC readiness, including alert generation, enrichment, triage, escalation, investigation, containment, and documentation processes.
• Evaluate technical controls, operational procedures, and automated response playbooks.
• Produce root cause analyses, remediation recommendations, and re-testing activities until objectives are achieved.
• Develop automation assets, reusable testing content, integrations, and reporting mechanisms using Python, PowerShell, Bash, APIs, and CI/CD pipelines.
• Maintain ATT&CK-aligned coverage metrics and reporting on detection performance and remediation progress.
• Facilitate purple team workshops, after-action reviews, and knowledge-sharing sessions with SOC stakeholders.

Connaissances

MITRE ATT&CK knowledge

Adversary emulation

Red Team experience

Purple Team experience

Detection Engineering

English communication

Network security monitoring

Formation

University degree in Information Security, Computer Science, or Engineering

Outils

KQL (Kusto)

Python

PowerShell

Bash

APIs

CI/CD

Microsoft Sentinel

Microsoft Defender XDR

SIEM

EDR/XDR

SOAR

Cloud security logging

Windows

Linux

Active Directory

Entra ID

Microsoft 365

Description du poste

Neotalent Conclusion in Madrid is seeking a Purple Team Specialist to join our cybersecurity team, working with a leading global insurance client in an international environment. You will lead adversary emulation, threat hunting, and detection engineering efforts within MITRE ATT&CK-aligned workflows.

The role requires 3–7 years in security, hands-on Red/ Purple Team experience, and strong skills in KQL, SIEM, and cloud security.