Senior Cloud Detection Engineer - AWS & Azure, Elastic Stack, Sentinel, KQL, EQL, SOC - Global B2B SaaS

Smart Sourcer Limited; United Kingdom; On-site; GBP 70,000 - 110,000; Full time

Job summary

Smart Sourcer Limited in the United Kingdom is seeking a Senior Cloud Detection Engineer to own cloud-native security threat detection and response for global SaaS products. You will build and optimise threat detection capabilities using Elastic Stack and Azure Sentinel, design threat models for AWS and Azure, and develop incident response playbooks.

Ideal candidates have hands-on experience with KQL and EQL, SOAR tooling, automation (PowerShell/Python), and collaboration with MSSPs or external

Qualifications

• Background in security operations or SOC roles.
• Hands-on detection rule writing in KQL & EQL.
• Experience with Elastic Stack and Azure Sentinel.

Responsibilities

• Build and optimise Threat Detection capabilities in Elastic and Azure Sentinel.
• Develop Threat Models for AWS & Azure and our global SaaS products.
• Create and maintain incident response playbooks.
• Automate response actions with the Security Team.
• Partner with our external SOC to refine detection strategies.
• Perform threat hunting and analysis across large-scale cloud environments.
• Tune rules to reduce false positives.
• Document detection logic and playbook procedures.

Skills

Threat Detection

Threat Hunting

Incident Response

Automation & Orchestration

PowerShell

Python

SOC Operations

Communication

Tools

Elastic Stack

Azure Sentinel

KQL

EQL

CloudTrail

GuardDuty

Security Hub

Tines

Shuffler

Tracecat

Job description

Senior Cloud Detection Engineer - AWS & Azure, Elastic Stack, Sentinel, KQL, EQL, SOC - Global B2B SaaS

Outstanding opportunity to join this global B2B SaaS organisation looking for a Senior Cloud Detection Engineer to take ownership of cloud‑native security threat detection and response capability. If you thrive in high‑scale cloud environments and love building smart detections and automated response workflows, this role gives you real technical impact.

What You’ll Do:

• Build and optimise Threat Detection capabilities in Elastic and Azure Sentinel
• Develop Threat Models for AWS & Azure and our global SaaS products
• Create and maintain incident response playbooks
• Automate response actions with the Security Team
• Partner with our external SOC to refine detection strategies
• Perform threat hunting and analysis across large‑scale cloud environments
• Tune rules to reduce false positives
• Document detection logic and playbook procedures

What You Bring:

• Background in security operations or SOC roles
• Strong experience with Elastic Stack and/or Azure Sentinel
• Hands‑on detection rule writing in KQL & EQL
• Deep understanding of AWS & Azure security ideally in a global SaaS context
• Experience with automation tools (Tines, Shuffler, Tracecat)
• Familiarity with MITRE ATT&CK or similar frameworks
• Playbook and incident response experience
• Strong communication skills and ability to work independently
• SOAR experience
• PowerShell & Python scripting
• Cloud‑native security tools (CloudTrail, GuardDuty, Security Hub)
• Security certifications (GIAC, CEH, CISSP, etc.)
• Experience working with MSSPs or external SOCs