Threat Detection Engineer

CGI Group Inc.; Reading; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Insurance coverage

Medical benefits

Pension plan

Flexible time off

Job summary

CGI Group Inc. is seeking a Cyber Security Detection Engineer to design, develop and optimise advanced threat detection across complex client environments.

You will translate threat intelligence into actionable detection rules and use cases, working with SOC teams and security specialists to strengthen threat visibility. You will own detection engineering across enterprise-scale projects, mentor colleagues, maintain detection use case libraries, and pursue automation opportunities to improve

Qualifications

• Proven experience designing, developing and tuning cyber security detection rules across SIEM platforms.
• Hands-on knowledge of at least one SIEM: Sentinel, FortiSIEM, Elastic or ArcSight.

Responsibilities

• Engineer and optimise SIEM detection rules to improve threat identification.

Skills

Detection Engineering

SIEM Rules

SOC Operations

Threat Intelligence

MITRE ATT&CK

Agile Delivery

Version Control

Security Architecture

Technical Consultancy

Problem Solving

Tools

Microsoft Sentinel

FortiSIEM

Elastic

ArcSight

Job description

At CGI, we help organisations stay ahead of evolving cyber threats by delivering innovative security solutions that protect critical systems, services and infrastructure. As a Cyber Security Detection Engineer, you'll play a vital role in strengthening threat detection capabilities across government, defence, financial services and other essential industries. You'll take ownership of complex engineering challenges, transform threat intelligence into actionable security solutions and develop advanced detection capabilities that make a measurable difference. Working alongside our collaborative community of cyber security specialists, you'll have the freedom to innovate, influence technical decisions and develop your expertise, supported by a team committed to delivering exceptional security outcomes for our clients.

In this role, you will take ownership of designing, developing and optimising advanced cyber threat detection capabilities across diverse and complex client environments. Working closely with Security Operations Centre (SOC) teams, security specialists and client stakeholders, you will translate emerging threats, intelligence and security requirements into effective detection rules and actionable use cases. Your expertise will directly contribute to improving threat visibility, strengthening security operations and protecting critical infrastructure against evolving cyber risks.

You will have the opportunity to work independently on high-impact engineering projects while benefiting from the knowledge and support of CGI's wider cyber security community. Encouraged to challenge conventional approaches and introduce innovative detection techniques, you will help shape engineering best practices, mentor colleagues and deliver practical security improvements that enhance client resilience.

Key responsibilities include:

• Engineer & Optimise: Design, develop, test and tune SIEM detection rules across multiple platforms to improve threat identification and response capabilities.
• Detect & Defend: Translate cyber threat intelligence into actionable detection use cases, aligned with recognised frameworks such as MITRE ATT&CK.
• Consult & Influence: Provide expert technical security consultancy to clients, helping translate complex requirements into effective engineering solutions.
• Lead & Deliver: Take ownership of detection engineering activities across enterprise-scale security projects, delivering solutions aligned with client requirements.
• Collaborate & Support: Work alongside SOC teams, security engineers and technical stakeholders to strengthen detection coverage and operational effectiveness.
• Mentor & Guide: Act as a technical subject matter expert and escalation point, sharing knowledge and supporting the development of technical colleagues.
• Maintain & Improve: Manage detection use case libraries, rule repositories and supporting documentation, ensuring consistency, quality and traceability.
• Automate & Innovate: Identify opportunities to streamline detection engineering workflows through automation, agile practices and continuous improvement.

Due to the specific security requirements of this role, applicants must be British nationals and eligible to obtain full UK Security Check (SC) clearance without restrictions or caveats.

To succeed in this role, you will bring hands-on experience in cyber threat detection engineering, with the ability to design, implement and optimise SIEM detection rules across complex security environments. You will combine strong analytical and problem-solving skills with a practical understanding of SOC operations, threat intelligence and security frameworks. A proactive, organised approach and the confidence to work independently while collaborating with technical teams and clients will be essential.

Essential skills and experience include:

• Detection Engineering: Proven experience developing, testing and tuning cyber security detection rules across multiple SIEM platforms.
• SIEM Technologies: Hands-on operational knowledge of at least one of Microsoft Sentinel, FortiSIEM, Elastic or ArcSight.
• SOC Operations: Experience working within or alongside a Security Operations Centre, with an understanding of security monitoring and incident detection.
• Threat Intelligence: Strong understanding of cyber threat intelligence and its application to detection engineering and security use cases.
• Security Frameworks: Knowledge of MITRE ATT&CK and its application to threat detection, coverage analysis and security monitoring.
• Agile & Version Control: Experience using agile delivery methodologies, Git and code repositories to support engineering workflows.
• Security Architecture: Ability to understand wider security requirements and translate them into practical, scalable technical implementations.
• Technical Consultancy: Strong communication and stakeholder engagement skills, with the ability to provide clear, effective security guidance.
• Problem-solving: Excellent analytical skills, sound technical judgement and the ability to deliver effective solutions when requirements are ambiguous.
• Independent Delivery: Strong organisational skills, attention to detail and the ability to manage engineering tasks independently while contributing to team objectives.

Desirable experience includes:

• One to two years of practical experience with Microsoft Sentinel, FortiSIEM, Elastic or ArcSight.
• Experience working within Blue Team or Red Team security environments.
• Knowledge of DevOps practices, automated workflows and detection engineering pipelines.
• Coding or scripting experience, particularly with Python.
• Experience improving detection coverage and engineering processes through automation.

Life at CGI is rooted in ownership, teamwork, respect and belonging. Here, you'll reach your full potential because.

You are invited to be an owner from day 1 as we work together to bring our Dream to life. That's why we call ourselves CGI Partners rather than employees. We benefit from our collective success and actively shape our company's strategy and direction.

Your work creates value. You'll develop innovative solutions and build relationships with teammates and clients while accessing global capabilities to scale your ideas, embrace new opportunities, and benefit from expansive industry and technology expertise.

You'll shape your career by joining a company built to grow and last. You'll be supported by leaders who care about your health and well-being and provide you with opportunities to deepen your skills and broaden your horizons.

That same commitment to fairness extends to how we use technology. To support our recruitment team, AI tools may be used to help assess applications though they never replace human judgement. All hiring decisions remain entirely in the hands of our recruitment professionals.

Come join our team-one of the largest IT and business consulting services firms in the world.

Discover CGI

London, England, United Kingdom

> 1000 employees

IT services

We are a global business with 91,500 professionals across hundreds of locations worldwide, providing end-to-end IT and business process services that drive our clients' businesses. In the UK alone, we have around 6,000 member-partners working across 19 towns and cities, doing everything from writing complex code to designing sophisticated software solutions. The work we do powers some of the most ambitious projects that touch the lives of many. Our approach sets us apart, characterised by our proximity model, international presence, expertise, and operational excellence. We organise our operations within metro markets where our clients have concentrated footprints, empowering our local teams to build trusted, in-person relationships. As you build your career here, you'll develop your skills, share your insights, and work side-by-side with colleagues and clients on innovative solutions that address the most complex issues. Our commitment to ownership, flexibility, and being approachable makes us easy to do business with. Join us, and together, as owners, let's turn meaningful insights into action to meet the needs and balance the interests of our clients, shareholders, communities, and each other.

Benefits:

• Insurance coverage
• Medical benefits
• Pension plan
• Member Assistant Programme
• Check4Cancer
• Flexible time off
• Share Purchase Plan
• Member discounts
• Dental benefits
• Vision benefits
• Profit Participation Plan
• Health and Wellbeing Programme

CGI was recognised in the Sunday Times Best Places to Work List 2025 and has been named a UK 'Best Employer' by the Financial Times. We offer a competitive salary, excellent pension, private healthcare, plus a share scheme (3.5% + 3.5% matching) which makes you a CGI Partner not just an employee. We are committed to inclusivity, building a genuinely diverse community of tech talent and inspiring everyone to pursue careers in our sector, including our Armed Forces, and are proud to hold a Gold Award in recognition of our support of the Armed Forces Corporate Covenant. Join us and you'll be part of an open, friendly community of experts. We'll train and support you in taking your career wherever you want it to go.

Due to the secure nature of the programme, you will need to hold UK Security Clearance or be eligible to go through this clearance.