Detection Engineer

Apex 2000, Inc.; Bengaluru; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

Apex 2000, Inc. is seeking a Detection Engineer to lead the design and development of enterprise threat detections in Bangalore. The role focuses on building correlation rules, analytics, and risk-based detections aligned to MITRE ATT&CK and Kill Chain models.

You will shape the detection strategy and drive continuous improvement across the detection lifecycle. Responsibilities include developing detections in Splunk ES and other SIEM/XDR platforms, implementing enrichment, tuning, and alerting,

Qualifications

• Define and execute the organization’s detection engineering roadmap.
• Establish standards and governance for detection lifecycle management.
• Develop a comprehensive threat detection framework aligned to business risks.
• Drive continuous improvement of detection coverage against emerging threats.

Responsibilities

• Design, develop, and optimize detection content such as correlation rules, detection use cases, behavioral analytics, risk-based detections, and threat intelligence-driven detections.
• Develop detections aligned to MITRE ATT&CK, Cyber Kill Chain, industry threat intel and adversary TTPs.
• Build and optimize detections within SIEM/XDR platforms (Splunk ES and others) and craft SPL queries and advanced analytics.
• Implement risk-based alerting methodologies and reduce false positives through tuning and contextual enrichment.
• Own end-to-end detection lifecycle from requirement gathering, design, development, testing, deployment, tuning to retirement.
• Maintain detection documentation and knowledge repositories and track use case efficacy and operational performance.
• Integrate detections with SOAR, threat intel platforms (OpenCTI, MISP), EDR/XDR tools, IAM, and vulnerability management systems.
• Provide executive reporting on detection maturity and effectiveness.

Job description

Requirement ID: 8421 Job Title: Detection Engineer Job Type: - Duration: 12 months Location: Bangalore

Detection Engineering Strategy

• Define and execute the organizations detection engineering roadmap.
• Establish standards and governance for detection lifecycle management.
• Develop a comprehensive threat detection framework aligned to business risks.
• Drive continuous improvement of detection coverage against emerging threats.

Threat Detection Development

• Design, develop, and optimize:
  • Correlation rules
  • Detection use cases
  • Behavioral analytics
  • Risk-based detections
  • Threat intelligence-driven detections
• Develop detections aligned to:
  • MITRE ATT&CK
  • Cyber Kill Chain
  • Industry threat intelligence
  • Adversary TTPs

SIEM & Analytics Engineering

• Build and optimize detections within:
  • Splunk Enterprise Security
  • Other SIEM/XDR platforms
• Develop SPL queries and advanced analytics content.
• Implement Risk-Based Alerting (RBA) methodologies.
• Reduce false positives through tuning and contextual enrichment.

Security Content Management

• Own end-to-end detection lifecycle:
  • Requirement gathering
  • Design
  • Development
  • Testing
  • Deployment
  • Tuning
  • Retirement
• Maintain detection documentation and knowledge repositories.
• Track use case efficacy and operational performance.

Automation & Enrichment

• Integrate detections with:
  • SOAR platforms
  • Threat Intelligence Platforms (OpenCTI, MISP)
  • EDR/XDR tools
  • IAM platforms
  • Vulnerability management systems
• Automate contextual enrichment and alert prioritization.

Detection Metrics & Reporting

• Measure:
  • Detection coverage
  • Detection fidelity
  • False positive rates
  • Mean Time to Detect (MTTD)
  • Detection gap closure rates

Provide executive reporting on detection maturity and effectiveness.