Detection Engineer & Threat Hunter – SIEM & Cloud Security

Starling; Cardiff; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Private Medical Insurance

Life Insurance

Pension scheme

Cycle to Work

Salary Sacrificed Gym Partnerships

EV leasing

Job summary

Starling Bank is seeking a passionate Detection Engineer and Threat Hunter to join our Security Operations team. You will design, tune, and maintain detection rules across SIEMs, while proactively hunting for threats in cloud, SaaS, and endpoint environments.

You will collaborate with the Purple Team, provide incident response support, and help operationalise threat intelligence to strengthen our security posture. Hybrid working with office presence required.

Qualifications

• 3+ years in a technical security role (detection engineering, threat hunting, incident response, or threat intelligence).
• Strong understanding of MITRE ATT&CK and how to apply it to detection.
• Extensive SIEM experience with rule/query development and analytics.
• Solid knowledge of cloud security (AWS, GCP, Azure) and related risks.
• Experience with EDR tools and endpoint detection strategies.

Responsibilities

• Design, build, test, and maintain high-fidelity detection rules and analytics in SIEMs.
• Proactively hunt for attacker TTPs across cloud, SaaS, and endpoints.
• Collaborate with Adversarial Simulation teams in Purple Team exercises.
• Act as Incident Response SME during security incidents with deep technical analysis.
• Integrate and operationalise threat intelligence to inform detection strategies.
• Collaborate with Security Operations and stakeholders to uplift Starling’s security posture.
• Maintain documentation for detection rules, hunting playbooks, and processes.

Skills

Detection engineering

Threat hunting

SIEM expertise

Cloud security

EDR proficiency

OS internals

Scripting (Python)

Docker & Kubernetes security

SOAR platforms

Incident response

Threat intelligence

Tools

Splunk

Elastic

Google SecOps

AWS

Azure

GCP

CrowdStrike

SentinelOne

Cortex XDR

SOAR

Job description

Starling Bank is seeking a passionate Detection Engineer and Threat Hunter to join our Security Operations team. You will design, tune, and maintain detection rules across SIEMs, while proactively hunting for threats in cloud, SaaS, and endpoint environments.

You will collaborate with the Purple Team, provide incident response support, and help operationalise threat intelligence to strengthen our security posture. Hybrid working with office presence required.