Threat Hunter & Detection Engineer | Hybrid Role | Cloud & SIEM

Starling; Greater London; Hybrid; GBP 80,000 - 120,000; Full time

Benefits offered by this job

25 days holiday

Birthday day off

Pension scheme

Life insurance

Private Medical Insurance

Perkbox

Cycle to Work

EV leasing

Volunteer time

Salary sacrifice

Family-friendly policies

Job summary

Starling Bank is seeking a passionate Detection Engineer and Threat Hunter to join our growing Security Operations team. You will proactively identify and defend against threats by developing, tuning, and maintaining detection rules across our cloud, SaaS, and endpoint environments.

Reporting to the Information Security Lead, you will perform threat hunts, participate in Purple Team exercises, and support incident response with deep technical analysis.

Qualifications

• 3+ years in a technical security role.
• Strong attacker knowledge with MITRE ATT&CK.
• Hands-on SIEM experience with rule/query creation.
• Experience performing proactive threat hunts.
• Knowledge of cloud security (AWS, GCP, Azure).
• Proficiency with EDR tools.
• Solid understanding of OS internals and network security.
• Excellent analytical and communication skills.

Responsibilities

• Design, build, test, and maintain high-fidelity detection rules and analytics.
• Proactively hunt for attacker TTPs across cloud, SaaS, and endpoints.
• Purple Team collaboration to test and improve detection logic.
• Incident response SME support with deep technical analysis.
• Threat intelligence integration to inform detection strategies.
• Collaborate with Security Operations and stakeholders to uplift security posture.
• Maintain documentation for detection rules, playbooks, and processes.

Skills

Threat hunting

Detection engineering

SIEM analytics

Cloud security

EDR tools

OS internals

Communication

Self-starter

Tools

Splunk

Google SecOps

Elastic

Microsoft Sentinel

CrowdStrike

Cortex XDR

Job description

Starling Bank is seeking a passionate Detection Engineer and Threat Hunter to join our growing Security Operations team. You will proactively identify and defend against threats by developing, tuning, and maintaining detection rules across our cloud, SaaS, and endpoint environments.

Reporting to the Information Security Lead, you will perform threat hunts, participate in Purple Team exercises, and support incident response with deep technical analysis.