Remote Detection Engineer - SIEM & Threat Detection

Reap; Hong Kong; On-site; HKD 900,000 - 1,200,000; Full time

Benefits offered by this job

Remote-first

APAC-friendly hours

Home office budget

Competitive compensation

Job summary

Reap is seeking a security-focused engineer to own and evolve our SIEM strategy in a remote-first environment. You will design and implement production-grade detection rules, ingest logs from CrowdStrike, AWS CloudTrail, Okta, and M365, and translate MITRE ATT&CK into testable detections.

Collaboration with a global security team will be essential to reduce risk and improve incident response. You will build dashboards, automate reporting, and support AI-related detection efforts to protect our

Qualifications

• Experience building detection rules from scratch for SIEM platforms.
• Ability to translate MITRE ATT&CK into testable detections.
• Hands-on log source integration across multiple services (AWS, Okta, M365, CrowdStrike).

Responsibilities

• Own the SIEM platform from evaluation to production detection capability, including platform choice and rule library development.
• Write detection rules for Lazarus Group, credential harvesting, lateral movement, social engineering, and cloud misconfigurations.
• Own alert triage, define SLAs, reduce false positives, and coordinate with IR security engineers on incidents.
• Operationalise threat intelligence by ingesting feeds and translating IOCs and TTPs into rules.
• Build security metrics dashboards and automated reports for leadership.
• Support CrowdStrike Falcon Complete configuration and tailor detection logic for our environment.
• Create AI-related detection rules for AI platform data flows and anomalous SaaS activity.

Skills

SIEM engineering

Threat detection rules

CrowdStrike

Microsoft Sentinel

Splunk

Elastic

Python for security automation

MITRE ATT&CK mapping

AWS CloudTrail

Okta logs

M365 logs

Tools

CrowdStrike

AWS CloudTrail

Okta

M365

KQL

SPL

Threat intelligence feeds

Job description

Reap is seeking a security-focused engineer to own and evolve our SIEM strategy in a remote-first environment. You will design and implement production-grade detection rules, ingest logs from CrowdStrike, AWS CloudTrail, Okta, and M365, and translate MITRE ATT&CK into testable detections.

Collaboration with a global security team will be essential to reduce risk and improve incident response. You will build dashboards, automate reporting, and support AI-related detection efforts to protect our