Senior Detection & Response Engineer - From-Scratch Build

Open Select; Greater London; Hybrid; GBP 122,000 - 149,000; Full time

Job summary

Open Select in London is seeking a hands-on Detection Engineer to build a from-scratch security detection and response capability for a fintech platform handling large daily transactions.

You will implement telemetry, tooling, and processes across AWS, on‑premise, Workforce IT and endpoints, reporting to the CISO and CTO.

Responsibilities include MITRE ATT&CK coverage, SOAR-driven containment, threat hunting, and leadership in a growing security function.

Qualifications

• Hands-on detection engineering experience with SIEM and detection-as-code pipelines.
• Strong Python development for detection, parsing and automation.
• Incident response leadership with P1/P2 investigations.
• Experience with cloud security on AWS and/or Azure and native telemetry.
• Familiarity with MITRE ATT&CK for detection design and gaps.
• Experience building SOAR playbooks across SIEM/EDR/cloud/ticketing.
• Ability to influence stakeholders and translate technical findings.

Responsibilities

• Build detection and response capability from ground up, with telemetry and tooling.
• Create asset/telemetry maps across AWS, on-prem, Workforce IT and endpoints.
• Develop risk-based plan for hybrid SOC using engineering collaboration.
• Define MITRE ATT&CK coverage for Tier 1 tactics and maintain as code.
• Author and maintain incident playbooks; automate containment via SOAR.
• Set and monitor MTTD/MTTR baselines; lead threat hunting cycles quarterly.
• Review unpatchable vulns with engineering and propose remediation.
• Produce monthly detection and response metrics for leadership.

Skills

Detection engineering

Python

Incident response

MITRE ATT&CK

SOAR

SIEM

EDR

Threat hunting

Cloud security

Stakeholder communication

Leadership

Tools

AWS

Azure

SIEM

SOAR

EDR

Git

Ticketing systems

Job description

Open Select in London is seeking a hands-on Detection Engineer to build a from-scratch security detection and response capability for a fintech platform handling large daily transactions.

You will implement telemetry, tooling, and processes across AWS, on‑premise, Workforce IT and endpoints, reporting to the CISO and CTO.

Responsibilities include MITRE ATT&CK coverage, SOAR-driven containment, threat hunting, and leadership in a growing security function.