Senior Cyber Use Case Developer

Sun Life Financial; Ireland; On-site; EUR 62,000 - 93,000; Full time

Job summary

Sun Life Financial is seeking a Senior Cyber Use Case Developer to lead design, development, testing and continuous improvement of advanced security monitoring use cases across SIEM, EDR, XDR, and cloud environments. You’ll translate threat intelligence into high-fidelity detection logic and mentor the team.

As part of the Security Operations and Threat Hunting groups, you will champion best practices, measure detector performance, and stay ahead of evolving threats and technologies to protect

Qualifications

• Post-secondary education in Cyber Security, IT, CS, IS, Engineering, or related field or equivalent practical experience.
• 5+ years in security operations, detection engineering, threat hunting, incident response or related cyber security function.
• Experience leading detection use case development and SIEM content engineering.

Responsibilities

• Lead development and lifecycle management of cyber security detection use cases across SIEM, EDR, XDR, cloud, identity, network and endpoints.
• Translate attacker tactics and threat intel into scalable, high-fidelity detection logic.
• Design, test, tune, and peer review advanced correlation rules and analytics.
• Establish use case development standards and deployment readiness.
• Improve data source reliability and coverage through collaboration with engineering.
• Mentor team members and drive continuous improvement of detection practices.

Skills

SPL

KQL

Python

PowerShell

MITRE ATT&CK

Threat Detection

Education

Bachelor's degree in Cyber Security

Tools

Splunk

SIEM

EDR/XDR

Cloud Security

Job description

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights.

Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do. At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful. When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives. Discover how you can make a difference in the lives of individuals, families and communities around the world.

Job Description

The Senior Cyber Use Case Developer is responsible for leading the design, development, testing, and continuously improvement of advanced security monitoring use cases that detect suspicious activity, policy violations, and potential cyber threats across complex enterprise environments. This role provides subject matter expertise in detection engineering, threat-informed defence, telemetry analysis, and alert optimization, translating adversary behaviours, business risks, and operational requirements into actionable, high-fidelity detection logic. The senior developer acts as a technical lead and trusted advisor for various teams, including Security Operations, Cyber Threat Hunting, Cyber Threat Intelligence, Incident Response. The role helps mature the organization’s detection capability by improving coverage of priority threats, reducing false positives, standardizing use case lifecycle practices, and ensuring detections remain effective as threats, technologies, and business priorities evolve.

Key Responsibilities

• Lead the development, enhancement, and lifecycle management of cyber security detection use cases across SIEM, EDR, XDR, cloud, identity, network, endpoint, and application telemetry sources.
• Translate adversary tactics, techniques, procedures, threat intelligence, incident learnings, and business risk scenarios into scalable, high-fidelity detection logic aligned to frameworks such as MITRE ATT&CK.
• Design, write, test, tune, and peer review advanced correlation rules, search queries, analytics, dashboards, and alert logic using platforms.
• Establish and maintain use case development standards, including intake, prioritization, design documentation, validation, deployment readiness, tuning, change control, performance measurement, and retirement criteria.
• Assess enterprise telemetry coverage, data quality, parsing, normalization, and logging gaps, and partner with engineering teams to improve data source reliability and detection readiness.
• Lead detection gap assessments and coverage mapping for priority threat scenarios, critical assets, attack paths, control failures, and emerging threat behaviours.
• Partner with Threat Hunting and Threat Intelligence teams to operationalize intelligence, hypotheses, and hunting outcomes into durable monitoring content and proactive detection capabilities.
• Drive false-positive reduction and alert quality improvements through structured tuning, enrichment, suppression logic, threshold refinement, and feedback from operational teams.
• Support purple team, attack simulation, breach and attack emulation, tabletop, and control validation exercises to test and improve detection coverage.
• Measure and report use case performance through metrics such as alert volume, precision, true-positive rate, false-positive rate, coverage, mean time to detect, and operational usefulness.
• Be a mentor for the team and contribute to knowledge sharing, peer reviews, technical training, and continuous improvement of detection development practices.
• Stay current on emerging threats, vulnerabilities, adversary tradecraft, cloud and identity attack techniques, and security monitoring best practices, and apply those insights to detection strategy.

Qualifications

• Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, Engineering, or a related field, or equivalent practical experience.
• 5 or more years of experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, security engineering, or a related cyber security function.
• Relevant certifications such as CompTIA CySA+, GIAC GCIH, GCIA, GCTI, GCDA, GCFA, CISSP, Microsoft Security certifications, Splunk certifications, cloud security certifications, or MITRE ATT&CK Defender.
• Demonstrated experience leading or materially contributing to detection use case development, SIEM content engineering, alert tuning, and use case lifecycle management in an enterprise environment.
• Advanced hands-on experience working with SIEM, EDR, XDR, cloud security, identity, network, endpoint, and application telemetry.
• Strong proficiency writing detection logic or search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, regular expressions, or similar.
• Deep understanding of attacker behaviours, malware techniques, persistence, privilege escalation, lateral movement, credential abuse, phishing, data exfiltration, cloud compromise, and identity-based attacks.
• Strong working knowledge of security frameworks and methodologies such as MITRE ATT&CK, Cyber Kill Chain, NIST, CIS Controls, detection engineering frameworks, and threat-informed defence practices.
• Experience analyzing complex security telemetry and incident data to identify detection gaps, define requirements, and produce actionable findings.
• Ability to lead technical discussions, influence stakeholders, mentor peers, and communicate detection strategy clearly to technical and non-technical audiences.
• Strong documentation, quality assurance, prioritization, and stakeholder management skills.

Salary Range: €62,200 - €93,300

At our company, we are committed to pay transparency and equity. Your actual base salary will be determined based on your unique skills, qualifications, experience and education. In addition to your base salary, this position is eligible for a discretionary annual incentive award based on your individual performance as well as the overall performance of the business. We are dedicated to creating a work environment where everyone is rewarded for their contributions.

Job Category: IT - Technology Services Posting End Date: 27/08/2026

Shine together At Sun Life, you can be your most brilliant self. Our supportive, flexible, and inclusive work environment is one where you – and your career – can thrive. Whatever your aspirations, collaborative leaders and colleagues are ready to help you learn, grow, and succeed. Make life brighter We’re a global company with a passion for people. Our purpose is to help Clients achieve lifetime financial security and live healthier lives. As a team of 30,000 across 26 countries, our impact is far-reaching, and locally relevant There’s power in numbers. As part of Sun Life’s growing team, you have an impact on people in your community and around the world. Shape the future With an optimistic eye on a brighter future, we drive to innovate. Be part of leading change, push boundaries and try new ways of working. Use data to drive bold actions. Be agile and pivot as we test and learn. At Sun Life, we’re driving transformation, sustainability and innovation for our Clients, employees, partners, and communities.