Senior Threat-Led Detection Engineer - Hybrid UK

Hamilton Barnes; Royal Leamington Spa, Manchester, Warrington; Hybrid; GBP 78,000 - 88,000; Full time

Job summary

Hamilton Barnes is seeking a Senior SOC Detection Engineer for a 6-month initial contract. Hybrid work across UK locations, Inside IR35.

You will design and continuously improve threat-led detection capabilities, translating threat intelligence and red team findings into high‑fidelity detections and owning the full detection content lifecycle. Expertise across MITRE ATT&CK, SIEM/EDR platforms, and detection automation is required.

Qualifications

• 8+ years in detection engineering, threat hunting, or security operations.
• Experience creating behavioural detections aligned to MITRE ATT&CK.
• Proficiency in KQL, SPL, Sigma, Python, and PowerShell.
• Knowledge of threat intelligence, adversary tradecraft, and attack paths.
• Broad security domain knowledge across Identity, Cloud, Endpoint, Network, and Email.

Responsibilities

• Design, develop, and maintain threat-led detection content aligned to MITRE ATT&CK and threat models.
• Develop detections across endpoint, identity, cloud, network, email, and application telemetry.
• Assess detection coverage and define requirements for improved monitoring.
• Validate detections through attack simulations and adversary emulation.
• Develop automation to support detection testing, validation, and reporting.

Skills

Threat-led detection engineering

SIEM & EDR platform expertise

Detection analytics & automation

Threat analysis & adversary tradecraft

Security domain breadth

Tools

Microsoft Sentinel

Splunk

Elastic

Chronicle

Defender

CrowdStrike

SentinelOne

Job description

Hamilton Barnes is seeking a Senior SOC Detection Engineer for a 6-month initial contract. Hybrid work across UK locations, Inside IR35.

You will design and continuously improve threat-led detection capabilities, translating threat intelligence and red team findings into high‑fidelity detections and owning the full detection content lifecycle. Expertise across MITRE ATT&CK, SIEM/EDR platforms, and detection automation is required.