Threat Detection Engineer

Free-Work UK; Reading; Hybrid; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Private healthcare

Share scheme

Pension

Job summary

CGI is seeking a Cyber Security Detection Engineer to design, develop and optimise advanced SIEM detection rules across complex client environments. You will translate threat intelligence into actionable detections, working closely with SOC teams to improve threat visibility and incident response.

Based in Reading, Berkshire (hybrid) with eligibility for UK Security Check clearance, you will mentor colleagues and contribute to engineering best practices while delivering practical security

Qualifications

• Hands-on experience in cyber threat detection engineering across complex security environments
• Ability to design, implement and optimise SIEM detection rules
• Experience with security operations centre (SOC) monitoring and threat intel integration

Responsibilities

• Design, develop, test and tune SIEM detection rules across platforms
• Translate threat intel into detection use cases
• Provide technical security consultancy to clients
• Lead detection engineering activities on enterprise-scale projects
• Collaborate with SOC teams and stakeholders to strengthen detection coverage
• Mentor colleagues and share engineering best practices
• Maintain detection use case libraries and documentation
• Identify opportunities to automate detection engineering workflows

Skills

Detection Eng

SIEM Rules

SOC Operations

Threat Intelligence

MITRE ATT&CK

Agile & Git

Security Architecture

Technical Consultancy

Problem Solving

Independent Delivery

Tools

Microsoft Sentinel

FortiSIEM

Elastic

ArcSight

Job description

At CGI, we help organisations stay ahead of evolving cyber threats by delivering innovative security solutions that protect critical systems, services and infrastructure. As a Cyber Security Detection Engineer, you’ll play a vital role in strengthening threat detection capabilities across government, defence, financial services and other essential industries. You’ll take ownership of complex engineering challenges, transform threat intelligence into actionable security solutions and develop advanced detection capabilities that make a measurable difference. Working alongside our collaborative community of cyber security specialists, you’ll have the freedom to innovate, influence technical decisions and develop your expertise, supported by a team committed to delivering exceptional security outcomes for our clients.

CGI was recognised in the Sunday Times Best Places to Work List 2025 and has been named a UK ‘Best Employer’ by the Financial Times. We offer a competitive salary, excellent pension, private healthcare, plus a share scheme (3.5% + 3.5% matching) which makes you a CGI Partner not just an employee. We are committed to inclusivity, building a genuinely diverse community of tech talent and inspiring everyone to pursue careers in our sector, including our Armed Forces, and are proud to hold a Gold Award in recognition of our support of the Armed Forces Corporate Covenant. Join us and you’ll be part of an open, friendly community of experts. We’ll train and support you in taking your career wherever you want it to go.

Due to the secure nature of the programme, you will need to hold UK Security Clearance or be eligible to go through this clearance.

Location: Reading, Berkshire or Bridgend, Wales

Employment Type: Permanent

Working Pattern: Hybrid

Due to the specific security requirements of this role, applicants must be British nationals and eligible to obtain full UK Security Check (SC) clearance without restrictions or caveats.

Candidate Profile

In this role, you will take ownership of designing, developing and optimising advanced cyber threat detection capabilities across diverse and complex client environments. Working closely with Security Operations Centre (SOC) teams, security specialists and client stakeholders, you will translate emerging threats, intelligence and security requirements into effective detection rules and actionable use cases. Your expertise will directly contribute to improving threat visibility, strengthening security operations and protecting critical infrastructure against evolving cyber risks.

You will have the opportunity to work independently on high-impact engineering projects while benefiting from the knowledge and support of CGI’s wider cyber security community. Encouraged to challenge conventional approaches and introduce innovative detection techniques, you will help shape engineering best practices, mentor colleagues and deliver practical security improvements that enhance client resilience.

Key Responsibilities Include

• Engineer & Optimise: Design, develop, test and tune SIEM detection rules across multiple platforms to improve threat identification and response capabilities.


• Detect & Defend: Translate cyber threat intelligence into actionable detection use cases, aligned with recognised frameworks such as MITRE ATT&CK.


• Consult & Influence: Provide expert technical security consultancy to clients, helping translate complex requirements into effective engineering solutions.


• Lead & Deliver: Take ownership of detection engineering activities across enterprise-scale security projects, delivering solutions aligned with client requirements.


• Collaborate & Support: Work alongside SOC teams, security engineers and technical stakeholders to strengthen detection coverage and operational effectiveness.


• Mentor & Guide: Act as a technical subject matter expert and escalation point, sharing knowledge and supporting the development of technical colleagues.


• Maintain & Improve: Manage detection use case libraries, rule repositories and supporting documentation, ensuring consistency, quality and traceability.


• Automate & Innovate: Identify opportunities to streamline detection engineering workflows through automation, agile practices and continuous improvement.

Required Qualifications To Be Successful In This Role

To succeed in this role, you will bring hands‑on experience in cyber threat detection engineering, with the ability to design, implement and optimise SIEM detection rules across complex security environments. You will combine strong analytical and problem‑solving skills with a practical understanding of SOC operations, threat intelligence and security frameworks. A proactive, organised approach and the confidence to work independently while collaborating with technical teams and clients will be essential.

Essential Skills And Experience Include

• Detection Engineering: Proven experience developing, testing and tuning cyber security detection rules across multiple SIEM platforms.


• SIEM Technologies: Hands‑on operational knowledge of at least one of Microsoft Sentinel, FortiSIEM, Elastic or ArcSight.


• SOC Operations: Experience working within or alongside a Security Operations Centre, with an understanding of security monitoring and incident detection.


• Threat Intelligence: Strong understanding of cyber threat intelligence and its application to detection engineering and security use cases.


• Security Frameworks: Knowledge of MITRE ATT&CK and its application to threat detection, coverage analysis and security monitoring.


• Agile & Version Control: Experience using agile delivery methodologies, Git and code repositories to support engineering workflows.


• Security Architecture: Ability to understand wider security requirements and translate them into practical, scalable technical implementations.


• Technical Consultancy: Strong communication and stakeholder engagement skills, with the ability to provide clear, effective security guidance.


• Problem‑Solving: Excellent analytical skills, sound technical judgement and the ability to deliver effective solutions when requirements are ambiguous.


• Independent Delivery: Strong organisational skills, attention to detail and the ability to manage engineering tasks independently while contributing to team objectives.

Desirable Experience Includes

• One to two years of practical experience with Microsoft Sentinel, FortiSIEM, Elastic or ArcSight.


• Experience working within Blue Team or Red Team security environments.


• Knowledge of DevOps practices, automated workflows and detection engineering pipelines.


• Coding or scripting experience, particularly with Python.


• Experience improving detection coverage and engineering processes through automation.