Senior Cloud Detection Engineer – AWS & Azure, Elastic & SOC

Smart Sourcer Limited; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

Smart Sourcer Limited is seeking a Senior Cloud Detection Engineer to own cloud‑native detection and response for large‑scale SaaS environments. You will build detections in Elastic Stack and Azure Sentinel, model threats for AWS & Azure, and create incident response playbooks with automated actions.

The role emphasizes hands‑on rule writing (KQL & EQL), collaboration with external SOCs, and threat hunting across global cloud deployments.

Qualifications

• 5+ years in security operations, threat detection, or SOC roles.
• Strong experience with Elastic Stack and/or Azure Sentinel.
• Hands‑on detection rule writing in KQL & EQL.
• Deep understanding of AWS & Azure security, ideally in a global SaaS context.
• Experience with automation tools (Tines, Shuffler, Tracecat).
• Familiarity with MITRE ATT&CK or similar frameworks.
• Playbook and incident response experience.
• Strong communication skills and ability to work independently.
• SOAR experience.
• PowerShell & Python scripting.
• Cloud‑native security tools (CloudTrail, GuardDuty, Security Hub).
• Security certifications (GIAC, CEH, CISSP, etc.).
• Experience working with MSSPs or external SOCs.

Responsibilities

• Build and optimise detections in Elastic and Azure Sentinel.
• Develop threat models for AWS & Azure and our global SaaS products.
• Create and maintain incident response playbooks.
• Automate response actions with the Security Team.
• Partner with our external SOC to refine detection strategies.
• Perform threat hunting and analysis across large‑scale cloud environments.
• Tune rules to reduce false positives.
• Document detection logic and playbook procedures.

Skills

Elastic Stack

Azure Sentinel

KQL

EQL

SOAR

PowerShell

Python

MITRE ATT&CK

Incident response

Communication

Tools

Tines

Shuffler

Tracecat

Job description

Smart Sourcer Limited is seeking a Senior Cloud Detection Engineer to own cloud‑native detection and response for large‑scale SaaS environments. You will build detections in Elastic Stack and Azure Sentinel, model threats for AWS & Azure, and create incident response playbooks with automated actions.

The role emphasizes hands‑on rule writing (KQL & EQL), collaboration with external SOCs, and threat hunting across global cloud deployments.