Cyber Use Case Developer

Sun Life Financial; Ireland; On-site; EUR 75,000 - 115,000; Full time

Job summary

Sun Life Financial is hiring a Cyber Use Case Developer to design, develop, test, and improve security monitoring use cases with emphasis on network security, telemetry, and threat detection across enterprise environments.

You will collaborate with Security Operations, Threat Hunting, and Incident Response teams to translate network behaviors and operational requirements into high-quality alerts, reducing false positives and enabling timely investigations.

Qualifications

• Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, or a related field, or equivalent practical experience.
• Experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, network operations or a related cyber security function.
• Hands-on experience working with network security tools and telemetry, including firewalls, proxies, DNS logs, DHCP logs, VPN platforms, IDS/IPS, NAC, packet capture, or similar technologies.
• Experience writing detection logic or search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, or similar.
• Strong understanding of network security concepts, common attacker behaviours, malware techniques, persistence methods, lateral movement, credential abuse, phishing, data exfiltration, cloud or identity-based attacks, and how these behaviours appear in network telemetry.

Responsibilities

• Develop, enhance, and maintain cyber security detection use cases across SIEM, EDR, XDR, cloud, identity, endpoint, and network security data sources.
• Translate adversary tactics, techniques, and procedures into practical detection logic aligned to MITRE ATT&CK.
• Map detection use cases to MITRE ATT&CK framework to ensure comprehensive adversary coverage.
• Write, test, and tune detection rules, search queries, analytics, and alert logic.
• Perform use case lifecycle management, including requirements gathering, design, development, validation, deployment, tuning, documentation, periodic review and retirement.
• Analyze network security telemetry, logs, alerts, packet metadata, flow data, and incident data to identify suspicious patterns.
• Create detections for network-based threats such as C2, lateral movement, beaconing, port scanning, suspicious remote access, anomalous DNS, data exfiltration, and policy violations.
• Collaborate with network security and engineering teams to understand network architecture, segmentation, traffic patterns, security controls, and logging requirements.
• Partner with Threat Hunting team to convert hunt findings into permanent detection use cases.
• Partner with Threat Intelligence team to operationalize intelligence into monitoring content and proactive detection capabilities.
• Collaborate with Defensive Security and Incident Response teams to ensure use cases generate actionable, high-fidelity alerts with clear triage guidance.
• Conduct false-positive analysis and continuously tune detection content to improve precision, reduce noise, and increase operational efficiency.
• Document use case logic, data source dependencies, alert handling instructions, validation results, and performance metrics.
• Support purple team, attack simulation, tabletop, and control validation activities to test and improve detection coverage.
• Track use case performance through metrics such as alert volume, true-positive rate, false-positive rate, coverage, and mean time to detect.
• Stay current on emerging threats, attack techniques, vulnerabilities, and security monitoring best practices.

Skills

SPL

KQL

SQL

Sigma

YARA

Python

PowerShell

Education

Post-secondary education in Cyber Security

Tools

Firewalls

Proxies

DNS Logs

DHCP Logs

VPN Platforms

IDS/IPS

NAC

Packet Capture

Job description

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do. At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful. When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives. Discover how you can make a difference in the lives of individuals, families and communities around the world.

Job Description

The Cyber Use Case Developer is responsible for designing, developing, testing, and continuously improving security monitoring use cases with a strong focus on network security, network telemetry, and threat detection across enterprise environments. This role works closely with Security Operations, Threat Hunting, Cyber Threat Intelligence, Incident Response, Network Security, and infrastructure teams to translate network behaviours, adversary tradecraft, business risks, and operational requirements into actionable detection logic and high-quality alerts. The analyst plays a key role in strengthening the organization’s ability to identify threats early across perimeter, internal, cloud, and hybrid networks; reduce false positives; improve alert fidelity; and support timely investigation and response.

Key Responsibilities

• Develop, enhance, and maintain cyber security detection use cases across SIEM, EDR, XDR, cloud, identity, endpoint, and network security data sources, including firewall, proxy, DNS, DHCP, VPN, IDS/IPS, NAC, and network traffic telemetry.
• Translate adversary tactics, techniques, and procedures into practical detection logic aligned to frameworks such as MITRE ATT&CK.
• Map detection use cases to MITRE ATT&CK framework to ensure comprehensive adversary coverage.
• Write, test, and tune detection rules, search queries, analytics, and alert logic.
• Perform use case lifecycle management, including requirements gathering, design, development, validation, deployment, tuning, documentation, periodic review and retirement.
• Analyze network security telemetry, logs, alerts, packet metadata, flow data, and incident data to identify suspicious patterns, detection gaps, and opportunities for improvement.
• Create detections for network-based threats such as command-and-control activity, lateral movement, beaconing, port scanning, suspicious remote access, anomalous DNS activity, data exfiltration, and policy violations.
• Collaborate with network security and engineering teams to understand network architecture, segmentation, traffic patterns, security controls, and logging requirements needed for effective detection coverage.
• Partner with Threat Hunting team to convert hunt findings into permanent detection use cases.
• Partner with Threat Intelligence team to operationalize intelligence into monitoring content and proactive detection capabilities.
• Collaborate with Defensive Security and Incident Response teams to ensure use cases generate actionable, high-fidelity alerts with clear triage guidance.
• Conduct false-positive analysis and continuously tune detection content to improve precision, reduce noise, and increase operational efficiency.
• Document use case logic, data source dependencies, alert handling instructions, validation results, and performance metrics.
• Support purple team, attack simulation, tabletop, and control validation activities to test and improve detection coverage.
• Track use case performance through metrics such as alert volume, true-positive rate, false-positive rate, coverage, and mean time to detect.
• Stay current on emerging threats, attack techniques, vulnerabilities, and security monitoring best practices.

Qualifications

• Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, or a related field, or equivalent practical experience.
• Experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, network operations or a related cyber security function.
• Hands‑on experience working with network security tools and telemetry, including firewalls, proxies, DNS logs, DHCP logs, VPN platforms, IDS/IPS, NAC, packet capture, or similar technologies.
• Experience writing detection logic or search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, or similar.
• Strong understanding of network security concepts, common attacker behaviours, malware techniques, persistence methods, lateral movement, credential abuse, phishing, data exfiltration, cloud or identity‑based attacks, and how these behaviours appear in network telemetry.
• Practical knowledge of TCP/IP, routing, switching, firewalls, VPNs, proxies, DNS, HTTP/S, TLS, email gateways, network segmentation, and secure network architecture.
• Experience using network analysis or monitoring platforms.
• Familiarity with security frameworks and methodologies such as MITRE ATT&CK, Cyber Kill Chain, NIST, CIS Controls, or similar.
• Ability to analyze large volumes of security data and identify patterns, anomalies, and actionable findings.
• Strong documentation, communication, and stakeholder management skills.

Job Category: IT - Technology Services Posting End Date: 22/09/2026

Shine together

At Sun Life, you can be your most brilliant self. Our supportive, flexible, and inclusive work environment is one where you – and your career – can thrive. Whatever your aspirations, collaborative leaders and colleagues are ready to help you learn, grow, and succeed.

Make life brighter

We’re a global company with a passion for people. Our purpose is to help Clients achieve lifetime financial security and live healthier lives. As a team of 30,000 across 26 countries, our impact is far-reaching, and locally relevant. There’s power in numbers. As part of Sun Life’s growing team, you have an impact on people in your community and around the world.

Shape the future

With an optimistic eye on a brighter future, we drive to innovate. Be part of leading change, push boundaries and try new ways of working. Use data to drive bold actions. Be agile and pivot as we test and learn. At Sun Life, we’re driving transformation, sustainability and innovation for our Clients, employees, partners, and communities.

Together, we can make the future brighter.