SOC Detection Engineer

LA International Computer Consultants Ltd; Manchester; On-site; GBP 85,000 - 110,000; Full time

Job summary

LA International Computer Consultants Ltd is seeking a Senior Detection Engineer to design and improve threat-led detection across enterprise telemetry. You will convert threat intelligence and incident learnings into high-fidelity detections, covering endpoints, identities, cloud, networks and applications.

The role focuses on attacker behavior analytics, telemetry strategy and Detection-as-Code practices, with collaboration across Threat+ Hunting+ IR+ SOC teams to continuously enhance

Qualifications

• Design and develop threat-led detection content aligned to MITRE ATT&CK.
• Translate threat intelligence into detections across telemetry.
• Develop behavioral, risk-based and correlated detections across multiple domains.
• Continuously tune detection logic to reduce false positives.
• Assess coverage, identify telemetry gaps, and define monitoring requirements.
• Validate detections through attack simulations and adversary emulation.
• Maintain documentation, ownership, and Detection-as-Code practices.
• Collaborate with Threat Intelligence, Hunting, IR, Red Team and SOC.

Responsibilities

• Design, develop and maintain threat-led detection content aligned to MITRE ATT&CK and threat models.
• Translate threat intel, hunting findings and incident lessons into detections.
• Develop detections across endpoint, identity, cloud, network, email and apps.
• Tune and optimise detection logic to improve fidelity and reduce FP.
• Assess coverage, identify telemetry gaps and define monitoring needs.
• Validate detections via attack simulations and adversary emulation.
• Maintain detection content documentation, ownership and standards.
• Collaborate with Threat Intelligence, Hunting, IR, Red Team and SOC.
• Identify automation opportunities for SOC processes.
• Develop automation for testing, validation and reporting.
• Design AI-enabled hypotheses and automated rule creation pipeline.

Skills

Threat-led detection development

Behavioral analytics

ATT&CK mapping

Detection tuning

Validation and life-cycle management

Education

Bachelor's degree in Cyber Security, Computer Science, Digital Forensics, Information Security or equivalent

Tools

KQL

SPL

Sigma

Python

PowerShell

Microsoft Defender

CrowdStrike

Job description

The Role

The Senior Detection Engineer is responsible for designing, developing and continuously improving threat-led detection capabilities that identify sophisticated attacker behaviors across the enterprise.

The role translates cyber threat intelligence, threat modelling outputs, red team findings, threat hunting insights and incident learnings into high-fidelity detection logic capable of identifying malicious activity while minimising false positives.

The individual owns the end-to-end life cycle of detection content, from threat analysis and hypothesis development through to detection design, validation, tuning, optimisation and retirement.

This is a specialist detection engineering role focused on attacker behavior analytics, detection coverage, telemetry strategy and continuous improvement of detection effectiveness. The role is not primarily responsible for day-to-day SIEM administration, platform support or security tooling operations.

Your responsibilities

1. Design, develop and maintain threat-led detection content aligned to MITRE ATT&CK and organisational threat models.
2. Translate threat intelligence, threat hunting findings, red/purple team outcomes and incident lessons learned into effective detections.
3. Develop behavioural, risk-based and correlated detections across endpoint, identity, cloud, network, email and application telemetry.
4. Continuously tune and optimise detection logic to improve detection fidelity, reduce false positives and enhance SOC effectiveness.
5. Assess detection coverage, identify telemetry and visibility gaps, and define requirements for improved monitoring and detection.
6. Validate detections through attack simulation, purple teaming and adversary emulation exercises.
7. Maintain detection content documentation, ownership, version control and engineering standards, including Detection-as-Code practices where applicable.
8. Collaborate with Threat Intelligence, Threat Hunting, Incident Response, Red Team and SOC Operations teams to continuously improve detection capabilities.
9. Identify opportunities to automate repetitive SOC analyst activities.
10. Develop automation to support detection testing, validation, reporting and life cycle management.
11. Design AI enabled hypotheses generate and automated rule creation pipeline.

Your Profile

1. Detection Engineering: Threat-led detection development, behavioral analytics, ATT&CK mapping, detection tuning, validation and life cycle management.
2. Threat Analysis & Hunting: Threat intelligence, threat modelling, adversary TTP analysis, attack path analysis and threat hunting methodologies.
3. Security Telemetry & Monitoring: Experience working with endpoint, identity, cloud, network, authentication and security telemetry across enterprise environments.
4. Detection Analytics & Automation: Development of detection logic using KQL, SPL, Sigma, Python and PowerShell, including data correlation and Detection-as-Code practices.
5. Security Operations & Incident Response: Strong understanding of incident response, threat hunting, attack investigation and detection effectiveness measurement.
6. Security Domains: Knowledge of Identity & Access Management, Active Directory, Cloud Security, Endpoint Security, Network Security and Email Security.

Desirable skills/knowledge/experience: (As applicable)

1. Bachelor's degree in Cyber Security, Computer Science, Digital Forensics, Information Security or equivalent experience.
2. 8+ years experience in Detection Engineering, Threat Hunting, Security Operations or Threat Research.
3. Demonstrable experience creating behavioural detections for sophisticated adversaries.
4. Experience developing enterprise-scale detections within Microsoft Sentinel, Splunk, Elastic, Chronicle or equivalent SIEM platforms.
5. Experience developing detections using endpoint telemetry from Microsoft Defender, CrowdStrike, SentinelOne or equivalent EDR/XDR platforms.
6. Experience translating threat intelligence and threat modelling outputs into operational detection use cases.
7. Experience supporting purple team exercises and adversary emulation activities.
8. Strong understanding of attacker tradecraft and common attack methodologies.

LA International is an award-winning partner of choice for many of the world's most influential companies and government organisations. Holding Enhanced Government Security Accreditation, we are recognised as the European market leader in the delivery of Security Cleared talent to organisations that demand the very highest levels of security, compliance and assurance.

A multiple award-winning organisation, having secured the prestigious Queens Award for Enterprise: International Trade over consecutive years. We are committed to fostering an inclusive, equitable and accessible workplace where everyone feels valued and supported. We welcome applications from all individuals, regardless of background or identity, and we encourage candidates who may not meet every listed requirement to still apply. If you require any adjustments or support during the recruitment process, please let us know and we will work with you to ensure a fair and accessible experience.

Please Note: If a high volume of applications is received, only candidates shortlisted will be contacted.