Security Detection Engineer - Cloud SIEM & Threat Hunting

McCabe & Barton; Greater London; On-site; GBP 70,000 - 110,000; Full time

Job summary

McCabe & Barton in the United Kingdom seeks an experienced Security Detection Engineer to own detection engineering and threat hunting across Azure and GCP environments. This hands-on role requires strong SIEM, cloud security, and automation expertise to operate independently in a fast-paced setting.

You will design and implement detection rules in Datadog or Sentinel, integrate monitoring with Azure and GCP, and automate alert triage using Terraform and scripting.

Qualifications

• Extensive experience building detection rules (SIEM/EDR/cloud-native tools).
• Deep knowledge of attack patterns (MITRE ATT&CK).
• Experience in SOC operations, threat analysis, or incident response.
• Familiarity with Azure Monitor and Log Analytics.
• Understanding of GCP Cloud Logging and Cloud Security Command Center.
• Proficiency in SQL; scripting in Python or PowerShell.
• Experience with Azure security architecture (Entra ID, networking, identity).
• Knowledge of financial services threats and regulatory requirements (DORA, FCA, SOC2).

Responsibilities

• Design and implement detection rules in Datadog or Sentinel/SIEM equivalent.
• Support UEBA to catch compromise early.
• Use Claude Code to develop detection logic and correlation rules.
• Build AI-powered anomaly detection (user behaviour, access patterns).
• Automate alert triage and prioritization.
• Integrate Datadog with Azure monitoring and GCP Cloud Logging.
• Use Terraform to automate detection deployment and configuration.
• Develop custom metrics and alerting for deal-sensitive operations.

Skills

Detection engineering

SIEM

Cloud security

Automation

Datadog

Azure Monitor

GCP Cloud Logging

Terraform

Python

PowerShell

SQL

EDR

MITRE ATT&CK

UEBA

On-call readiness

Tools

Datadog

Terraform

CrowdStrike

Microsoft Defender

Azure Sentinel

GCP Cloud Logging

Job description

McCabe & Barton in the United Kingdom seeks an experienced Security Detection Engineer to own detection engineering and threat hunting across Azure and GCP environments. This hands-on role requires strong SIEM, cloud security, and automation expertise to operate independently in a fast-paced setting.

You will design and implement detection rules in Datadog or Sentinel, integrate monitoring with Azure and GCP, and automate alert triage using Terraform and scripting.