SC-Cleared Detection Engineer - SOC/SIEM (Splunk & AWS)

Sanderson Government & Defence; City Of London; Hybrid; GBP 72,000 - 94,000; Full time

Job summary

Sanderson Government & Defence is seeking a Detection Engineer to join a high-profile cyber security programme supporting critical public sector services in London. The role blends detection engineering with SOC operations, building and tuning detections across AWS and Splunk environments.

You will work within a SOC to investigate incidents, reduce false positives, and strengthen security visibility while collaborating with engineers and stakeholders.

Qualifications

• Active SC Clearance (required).
• 1–3 years in SOC Analyst, Security Analyst, Detection Engineer, or SOC role.
• Strong hands-on experience with Splunk and SPL query development.
• Experience building, tuning, and maintaining SIEM detection rules.
• AWS security monitoring experience including CloudTrail, GuardDuty, IAM and VPC Logs.

Responsibilities

• Develop, test, and optimise Splunk detections and alerting logic.
• Create and maintain detection use cases aligned to attacker TTPs.
• Monitor and investigate security incidents in the SOC and Splunk SIEM.
• Map detection coverage to MITRE ATT&CK framework.

Skills

Splunk SPL

Threat detection

SIEM tuning

AWS security monitoring

Tools

Splunk

CloudTrail

GuardDuty

IAM

VPC Flow Logs

Job description

Sanderson Government & Defence is seeking a Detection Engineer to join a high-profile cyber security programme supporting critical public sector services in London. The role blends detection engineering with SOC operations, building and tuning detections across AWS and Splunk environments.

You will work within a SOC to investigate incidents, reduce false positives, and strengthen security visibility while collaborating with engineers and stakeholders.