Senior Cloud Detection Engineer - AWS & Azure, Elastic Stack, Sentinel, KQL, EQL, SOC - Global B2B SaaS

Smart Sourcer Limited; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

Smart Sourcer Limited is seeking a Senior Cloud Detection Engineer to own cloud‑native detection and response for large‑scale SaaS environments. You will build detections in Elastic Stack and Azure Sentinel, model threats for AWS & Azure, and create incident response playbooks with automated actions.

The role emphasizes hands‑on rule writing (KQL & EQL), collaboration with external SOCs, and threat hunting across global cloud deployments.

Qualifications

• 5+ years in security operations, threat detection, or SOC roles.
• Strong experience with Elastic Stack and/or Azure Sentinel.
• Hands‑on detection rule writing in KQL & EQL.
• Deep understanding of AWS & Azure security, ideally in a global SaaS context.
• Experience with automation tools (Tines, Shuffler, Tracecat).
• Familiarity with MITRE ATT&CK or similar frameworks.
• Playbook and incident response experience.
• Strong communication skills and ability to work independently.
• SOAR experience.
• PowerShell & Python scripting.
• Cloud‑native security tools (CloudTrail, GuardDuty, Security Hub).
• Security certifications (GIAC, CEH, CISSP, etc.).
• Experience working with MSSPs or external SOCs.

Responsibilities

• Build and optimise detections in Elastic and Azure Sentinel.
• Develop threat models for AWS & Azure and our global SaaS products.
• Create and maintain incident response playbooks.
• Automate response actions with the Security Team.
• Partner with our external SOC to refine detection strategies.
• Perform threat hunting and analysis across large‑scale cloud environments.
• Tune rules to reduce false positives.
• Document detection logic and playbook procedures.

Skills

Elastic Stack

Azure Sentinel

KQL

EQL

SOAR

PowerShell

Python

MITRE ATT&CK

Incident response

Communication

Tools

Tines

Shuffler

Tracecat

Job description

Senior Cloud Detection Engineer - AWS & Azure, Elastic Stack, Sentinel, KQL, EQL, SOC - Global B2B SaaS

Outstanding opportunity to join this global B2B SaaS organisation looking for a Senior Cloud Detection Engineer to take ownership of cloud‑native detection and response capability. If you thrive in high‑scale cloud environments and love building smart detections and automated response workflows, this role gives you real technical impact.

What You’ll Do:

• Build and optimise detections in Elastic and Azure Sentinel
• Develop threat models for AWS & Azure and our global SaaS products
• Create and maintain incident response playbooks
• Automate response actions with the Security Team
• Partner with our external SOC to refine detection strategies
• Perform threat hunting and analysis across large‑scale cloud environments
• Tune rules to reduce false positives
• Document detection logic and playbook procedures

What You Bring:

• 5+ years in security operations, threat detection, or SOC roles
• Strong experience with Elastic Stack and/or Azure Sentinel
• Hands‑on detection rule writing in KQL & EQL
• Deep understanding of AWS & Azure security ideally in a global SaaS context
• Experience with automation tools (Tines, Shuffler, Tracecat)
• Familiarity with MITRE ATT&CK or similar frameworks
• Playbook and incident response experience
• Strong communication skills and ability to work independently
• SOAR experience
• PowerShell & Python scripting
• Cloud‑native security tools (CloudTrail, GuardDuty, Security Hub)
• Security certifications (GIAC, CEH, CISSP, etc.)
• Experience working with MSSPs or external SOCs