Senior SOC Detection Engineer (EDR) – Hybrid & Cloud

Sanderson Recruitment; Greater London; Hybrid; GBP 54,000 - 94,000; Full time

Job summary

Sanderson Recruitment is seeking a Senior Security Engineer – Monitoring & Detection to secure large-scale, cloud-based environments supporting public sector and government services. The role focuses on threat detection, SIEM engineering, security monitoring, log management, and SOC optimisation.

You will work with SOC analysts, engineers, architects, and stakeholders in a hybrid setup across multiple UK locations.

Qualifications

• Active SC Clearance required.
• Strong hands-on experience in security operations, detection engineering, threat detection, or security monitoring.
• Experience securing cloud environments across AWS, Azure, or GCP.
• Expertise in Splunk and SPLYARA rule development, EDR detection engineering, or SIEM content development and tuning.
• Experience mapping detections to the MITRE ATT&CK framework.
• Strong understanding of modern security principles, including Zero Trust, identity-first security, secrets management, and network segmentation.
• Desirable: Experience with Cribl and security data pipeline management.
• Desirable: Knowledge of Kinesis, Amazon S3, Amazon Security Lake, or similar technologies.
• Desirable: Understanding of OCSF and security data normalisation.
• Desirable: Experience in government, defence, highly regulated industries, or the wider public sector.
• Desirable: Experience mentoring or leading engineers in a SOC or cyber security function.

Responsibilities

• Develop, tune, and maintain detection rules across SIEM, EDR, and threat detection platforms.
• Create and optimise detection logic using technologies such as Splunk and endpoint security solutions.
• Map detections against the MITRE ATT&CK framework to support comprehensive threat coverage.
• Improve detection quality by analysing alert fidelity, false positives, and operational effectiveness.
• Validate detections through testing, simulation exercises, and red-team scenarios.
• Manage and optimise log ingestion pipelines to provide high-quality, actionable security data.
• Configure routing, filtering, enrichment, and normalisation of security telemetry.
• Improve data efficiency through deduplication, data reduction, and flow summarisation.
• Support cloud-native data streaming and storage solutions.
• Ensure security data aligns with industry standards such as OCSF, with strong encryption and access controls.
• Translate technical risks into clear, business-focused recommendations.
• Collaborate with technical and non-technical stakeholders to improve security outcomes.
• Act as a trusted technical advisor across engineering and security teams.
• Mentor junior engineers and contribute to the growth of our wider cyber security function.

Skills

SC Clearance

Security Operations

Threat Detection

Detection Engineering

Security Monitoring

Cloud Security

Tools

Splunk

SPLYARA

EDR

SIEM

Job description

Sanderson Recruitment is seeking a Senior Security Engineer – Monitoring & Detection to secure large-scale, cloud-based environments supporting public sector and government services. The role focuses on threat detection, SIEM engineering, security monitoring, log management, and SOC optimisation.

You will work with SOC analysts, engineers, architects, and stakeholders in a hybrid setup across multiple UK locations.