Cyber Detection Use-Case Engineer

Sun Life; Dublin; On-site; EUR 45,000 - 67,000; Full time

Job summary

Sun Life in Ireland (Dublin) is seeking a Cyber Use Case Developer to design, develop, test, and continuously improve security monitoring use cases with a strong emphasis on network security and threat detection across enterprise environments.

You will work closely with Security Operations, Threat Hunting, Cyber Threat Intelligence, Incident Response, Network Security, and infrastructure teams to translate network behaviours into actionable detection logic and high-quality alerts, improving

Qualifications

• Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, or related field, or equivalent practical experience.
• Experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, network operations or related function.
• Hands-on experience with network security tools and telemetry (firewalls, proxies, DNS logs, DHCP logs, VPN, IDS/IPS, NAC, packet capture).
• Experience writing detection logic or queries using SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, or similar.
• Strong understanding of network security concepts and attacker behaviours in network telemetry.
• Practical knowledge of TCP/IP, routing, switching, firewalls, VPNs, proxies, DNS, HTTP/S, TLS, and secure network architecture.
• Experience using network analysis or monitoring platforms.
• Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST, CIS Controls, or similar.
• Ability to analyze large volumes of security data and identify patterns and actionable findings.
• Strong documentation, communication, and stakeholder management skills.

Responsibilities

• Develop, enhance, and maintain cyber security detection use cases across multiple data sources (SIEM, EDR, XDR, cloud, identity, endpoint, network).
• Translate attacker techniques into practical detection logic aligned to MITRE ATT&CK.
• Map detection use cases to MITRE ATT&CK for comprehensive coverage.
• Write, test, and tune detection rules and alert logic.
• Manage use case lifecycle: requirements, design, deployment, tuning, documentation, review, retirement.
• Analyze telemetry and logs to identify patterns and improve detection.
• Create detections for network-based threats (C2, lateral movement, beaconing, port scanning, exfiltration).
• Collaborate with network security and engineering to understand architecture and logging needs.
• Partner with Threat Hunting to convert findings into use cases and operationalize intelligence with Threat Intelligence.
• Collaborate with Defensive Security and Incident Response to ensure actionable, high-fidelity alerts with clear triage guidance.
• Conduct false-positive analysis and tune content to improve precision.
• Document use case logic, data dependencies, alert handling, validation, and performance metrics.
• Support purple team activities to test detection coverage.
• Track performance with metrics like alert volume and mean time to detect.
• Stay current on emerging threats and best practices.

Skills

Security operations

Threat hunting

Incident response

Threat intelligence

Documentation / stakeholder management

Education

Post-secondary education in Cyber Security / IT / CS

Tools

SPL

KQL

SQL

Sigma

YARA

Python

PowerShell

Job description

Sun Life in Ireland (Dublin) is seeking a Cyber Use Case Developer to design, develop, test, and continuously improve security monitoring use cases with a strong emphasis on network security and threat detection across enterprise environments.

You will work closely with Security Operations, Threat Hunting, Cyber Threat Intelligence, Incident Response, Network Security, and infrastructure teams to translate network behaviours into actionable detection logic and high-quality alerts, improving