Senior SOC Detection Engineer

DCV Technologies; Royal Leamington Spa; Hybrid; GBP 92,000 - 148,000; Full time

Job summary

DCV Technologies is seeking experienced Senior SOC Detection Engineers for a six-month contract across Leamington Spa, Manchester, or Warrington. This hands-on role focuses on designing, developing and optimising threat-led detection capabilities to identify sophisticated cyber threats.

You will own the end-to-end detection engineering lifecycle, translating threat intelligence and adversary techniques into detection rules to improve visibility and reduce false positives.

Qualifications

• Extensive hands-on experience in Detection Engineering or Security Operations.
• Strong knowledge of MITRE ATT&CK, TTPs and behavioral detection.
• Experience building detection logic with KQL, SPL, Sigma or scripting languages.
• Understanding of SIEM, EDR/XDR, telemetry and incident investigations.
• Experience with Detection-as-Code and automation.

Responsibilities

• Design, develop and maintain threat detection rules aligned with MITRE ATT&CK.
• Build behavioural analytics and detection use cases using KQL, SPL, Sigma, Python and PowerShell.
• Develop detection content across endpoint, identity, cloud, network and email telemetry.
• Perform detection tuning, validation, optimisation and false‑positive reduction.
• Translate threat intelligence, incident response findings and threat hunting insights into actionable detections.
• Support purple teaming, attack simulation and adversary emulation exercises.
• Identify detection coverage gaps and improve security monitoring capabilities.
• Implement Detection-as-Code, automation and detection lifecycle management.
• Collaborate with SOC, Threat Intelligence, Incident Response and Red Team specialists.
• Explore AI‑enabled detection hypotheses and automated rule creation.

Skills

Detection Engineering

Threat Hunting

Security Operations

MITRE ATT&CK

KQL

SPL

Sigma

Python

PowerShell

Incident Investigation

Tools

Microsoft Sentinel

Splunk

Elastic

Google Chronicle

Microsoft Defender

CrowdStrike

SentinelOne

Job description

Location: Leamington Spa, Manchester or Warrington

Working Pattern: Hybrid – 3 days onsite, 2 days remote

Contract: 6 months

Rate: Competitive market rates

Vacancies: 3

The Opportunity

We are recruiting experienced Senior SOC Detection Engineers for a six-month contract supporting enterprise cyber security operations. This hands‑on role focuses on designing, developing and optimising threat‑led detection capabilities to identify sophisticated cyber threats across complex environments.

You will own the end-to-end detection engineering lifecycle, translating threat intelligence, threat hunting findings and adversary techniques into effective detection rules that improve security visibility and reduce false positives.

Key Responsibilities

Design, develop and maintain threat detection rules aligned with MIT&CK.

• Build behavioural analytics and detection use cases using KQL, SPL, Sigma, Python and PowerShell.
• Develop detection content across endpoint, identity, cloud, network and email security telemetry.
• Perform detection tuning, validation, optimisation and false‑positive reduction.
• Translate threat intelligence, incident response findings and threat hunting insights into actionable detections.
• Support purple teaming, attack simulation and adversary emulation exercises.
• Identify detection coverage gaps and improve security monitoring capabilities.
• Implement Detection-as-Code, automation and detection lifecycle management.
• Collaborate with SOC, Threat Intelligence, Incident Response and Red Team specialists.
• Explore AI‑enabled detection hypotheses and automated rule creation.

Essential Skills and Experience

• Strong hands‑on experience in Detection Engineering, Threat Hunting or Security Operations.
• Practical knowledge of MIT&CK, attacker TTPs and behavioural threat detection.
• Experience developing detection logic using KQL, SPL, Sigma or scripting languages.
• Understanding of SIEM, EDR/XDR, security telemetry and incident investigation.
• Ability to independently design, test, tune and maintain detection content.

Desirable Experience

• Microsoft Sentinel, Splunk, Elastic or Google Chronicle.
• Microsoft Defender, CrowdStrike or SentinelOne.
• Purple teaming, threat modelling and Detection-as-Code.