Senior SIEM Platform & Detection Engineer

CyberOne; City of Westminster; Hybrid; GBP 70,000 - 95,000; Full time

Job summary

CyberOne is seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team in a hybrid role with monthly on-site London presence. You will design, develop, test, deploy, and tune analytics rules and detection content aligned with MITRE ATT&CK, delivering scalable telemetry and high-fidelity detections.

This role collaborates with Security Operations, Infrastructure, Cloud, and Application teams to implement automation using Logic Apps, Azure Functions, REST APIs,

Qualifications

• Proven experience in SIEM/detection engineering in large enterprises.
• Hands-on with Microsoft Sentinel and Defender XDR including Endpoint, Identity, Cloud.
• Experience tuning high-fidelity detections and threat-hunting queries.
• Experience onboarding telemetry into a SIEM and security telemetry integration.
• Ability to design secure solutions, perform risk assessments, and validate controls.

Responsibilities

• Act as SME for Microsoft Sentinel, detection engineering, and security monitoring architecture.
• Design, develop, test, deploy, and tune analytics rules and MITRE ATT&CK-aligned content.
• Engineer data connectors, ingestion pipelines, and custom parsers for SIEM.
• Develop logging standards, onboarding patterns, and governance.
• Design automation using Logic Apps, Azure Functions, REST APIs, PowerShell, and Python.
• Support security engineering activities including platform hardening and remediation.
• Integrate endpoint, identity, cloud, and network controls with SIEM and Defender ecosystem.
• Build dashboards and KPI reporting; produce high/low level designs and SOPs.
• Lead platform enhancements, migrations, upgrades, and incident support.

Skills

SIEM

Detection engineering

Security monitoring

Automation

Threat hunting

CI/CD

Git/version control

Security architecture

Cross-team collaboration

Education

Bachelor's degree in IT/Cyber Security

Tools

PowerShell

Python

Azure Functions

Logic Apps

REST APIs

Cribl

Azure Monitor

KQL

Job description

CyberOne is seeking an experienced SIEM Content & Platform Engineer to join the Cyber Security team in a hybrid role with monthly on-site London presence. You will design, develop, test, deploy, and tune analytics rules and detection content aligned with MITRE ATT&CK, delivering scalable telemetry and high-fidelity detections.

This role collaborates with Security Operations, Infrastructure, Cloud, and Application teams to implement automation using Logic Apps, Azure Functions, REST APIs,