Detection Engineering Lead - SIEM/XDR & SOAR Expert

Nomios; Basingstoke; On-site; GBP 90,000 - 120,000; Full time

Job summary

Nomios seeks a Senior Security Engineering Consultant to deliver advanced detection and automation across SIEM, XDR and SOAR, working directly with customers. You will own detection as code and define MITRE-aligned use cases while elevating visibility and response maturity within client environments.

This hands-on role blends engineering with advisory duties, enabling customers to evolve their detection capabilities and supporting secure, scalable SOC operations.

Qualifications

• Hands-on experience in SIEM engineering with detection rule development and tuning.
• Experience writing detection logic using KQL or similar query languages.
• Proven experience designing and implementing SOAR automations and playbooks such as Logic Apps, Cortex XSOAR or similar.
• Scripting and automation capability using Python, PowerShell or similar, including working with APIs.

Responsibilities

• Design and deliver detection rulesets across SIEM and XDR platforms.
• Develop and tune detection logic using KQL or equivalent query languages.
• Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques.
• Map customer log sources to detection use cases to assess coverage and identify gaps.
• Design and implement SOAR automations, integrations and response workflows.
• Develop and document customer incident response playbooks aligned to detection outputs.
• Translate threat intelligence and operational learnings into improved detections and automations.
• Deliver detection as code pipelines, including structured use case development and versioning approaches.
• Produce clear technical and customer-facing deliverables, including detection strategies, use case catalogues and coverage assessments.

Skills

SIEM engineering

KQL

SOAR automation

Python / PowerShell

MITRE ATT&CK

XDR/EDR

Microsoft Sentinel

Tools

Logic Apps

Cortex XSOAR

Job description

Nomios seeks a Senior Security Engineering Consultant to deliver advanced detection and automation across SIEM, XDR and SOAR, working directly with customers. You will own detection as code and define MITRE-aligned use cases while elevating visibility and response maturity within client environments.

This hands-on role blends engineering with advisory duties, enabling customers to evolve their detection capabilities and supporting secure, scalable SOC operations.