Detection Engineer & Threat Hunter - Hybrid Security Ops

Starling; Southampton; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Private Medical Insurance with Vitalty

Cycle to Work

Life Insurance 4x salary

Pension scheme

Genrous holiday plan

Job summary

Starling Bank is seeking an Information Security Analyst in Southampton to join the SecOps Detection team. You will develop, tune, and maintain detection rules, perform intelligence-driven threat hunts, and contribute to collaborative defence improvements to protect customers and assets.

You will work in a hybrid setup, collaborating with the team across AWS, GCP, Azure, SaaS and endpoints, and participate in proactive detection and incident response activities with a focus on strong analytics

Qualifications

• 3+ years in a technical security role such as detection engineering, threat hunting, incident response, or threat intelligence.
• Experience analysing attacker behaviour and applying MITRE ATT&CK to prioritize detective controls.
• Hands-on SIEM experience (Splunk, Google SecOps, Elastic, Sentinel) for rule/query creation and analytics.

Responsibilities

• Design, build, test, and maintain high-fidelity detection rules and analytics in our SIEM and other security platforms.
• Formulate hypotheses and hunt for undetected attacker TTPs across cloud, SaaS, and endpoints.
• Collaborate in Purple Team exercises to test and improve detection logic and response.
• Act as SME during security incidents, providing deep technical analysis and remediation aid.
• Integrate and operationalise threat intelligence to inform detection strategies and hunting projects.
• Work with Security Operations and other stakeholders to uplift Starling's security posture.
• Maintain clear documentation for detection rules, hunting playbooks, and processes.

Skills

Threat hunting

Threat analysis

Incident response

Communication

Self-starter

Tools

Splunk

Elastic

Job description

Starling Bank is seeking an Information Security Analyst in Southampton to join the SecOps Detection team. You will develop, tune, and maintain detection rules, perform intelligence-driven threat hunts, and contribute to collaborative defence improvements to protect customers and assets.

You will work in a hybrid setup, collaborating with the team across AWS, GCP, Azure, SaaS and endpoints, and participate in proactive detection and incident response activities with a focus on strong analytics