Threat Detection Engineer — Cloud Security & AI Automation

Additional Resources; Greater London; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

Additional Resources is seeking a Threat Detection Engineer in London with hybrid/remote options to design and implement threat-led detection and analytics. You will collaborate with an outsourced SOC and contribute to cloud-native security tooling across Azure, Office 365, and Kubernetes environments.

The role requires advanced KQL skills, experience with Microsoft Sentinel/Defender, and knowledge of ISO 27001. It offers a permanent position with a salary band of 60k–80k GBP plus benefits.

Qualifications

• Proven experience in threat detection engineering or related security role.
• Strong KQL expertise and hands-on with Microsoft Sentinel/Defender.
• Familiarity with Microsoft Entra ID including Identity Governance and Purview DLP.
• Experience with cloud-native logging in Azure and Kubernetes.
• Knowledge of attacker TTPs, threat modelling, and cyber security frameworks.
• Awareness of ISO 27001 standards and security compliance.

Responsibilities

• Design and implement threat-led detection logic informed by threat intelligence and hunting activities.
• Develop analytical techniques to identify incidents effectively.
• Collaborate with outsourced SOC to maintain and optimise detection catalogues.
• Create and refine DLP and other security rules using cloud-native tools.
• Monitor, tune, and ensure high-quality service delivery from external SOC providers.
• Automate reporting on security performance and operational metrics.

Skills

KQL

Threat intelligence

Agile

ISO 27001

Data science/AI security

Education

MS-500

AZ-500

SC-200

SC-300

SC-400

Security+

Tools

Microsoft Sentinel

Defender for Endpoint

Entra ID

Purview

DLP tools

Azure

Kubernetes

CI/CD

Job description

Additional Resources is seeking a Threat Detection Engineer in London with hybrid/remote options to design and implement threat-led detection and analytics. You will collaborate with an outsourced SOC and contribute to cloud-native security tooling across Azure, Office 365, and Kubernetes environments.

The role requires advanced KQL skills, experience with Microsoft Sentinel/Defender, and knowledge of ISO 27001. It offers a permanent position with a salary band of 60k–80k GBP plus benefits.