Detection Engineer - SOC

Capgemini; Pune District, Mumbai, Bengaluru; Hybrid; INR 2,000,000 - 4,000,000; Full time

Job summary

Capgemini is seeking a Detection Engineer to design, develop, validate, and optimize advanced threat detections across enterprise environments. You will build detection use cases, analytics rules, and content for security monitoring using Microsoft Sentinel, Defender XDR, and KQL.

The role emphasizes threat hunting, MITRE ATT&CK mapping, and detection content lifecycle management, with collaboration across SOC and incident response teams. Hybrid work model supported in Capgemini locations.

Qualifications

• 6+ years of experience in Detection Engineering, Threat Hunting, or Security Analytics.
• Strong hands-on experience with Microsoft Sentinel and Defender XDR.
• Expert knowledge of KQL (Kusto Query Language).
• Strong scripting skills in Python and PowerShell.
• Experience with SIEM/XDR rule creation, tuning, and validation.
• Deep understanding of MITRE ATT&CK and threat-informed defense.
• Experience with detection engineering, content lifecycle management, and analyst workflows.
• Knowledge of Windows, Linux, Active Directory, Entra ID, Azure, Microsoft 365, cloud, network, and endpoint security.

Responsibilities

• Design, develop, and maintain detection use cases, analytics rules, hunting queries, dashboards, and correlation logic.
• Create and tune detections in Microsoft Sentinel and Defender XDR.
• Translate threat intelligence, incident findings, red/purple team outputs, and emerging threats into actionable detection content.
• Perform threat hunting and identify opportunities to improve detection coverage.
• Map detections to the MITRE ATT&CK framework and identify coverage gaps.
• Validate and test detections using attack simulations, threat emulation, and historical data analysis.
• Reduce false positives through tuning, enrichment, suppression logic, and behavioral analysis.
• Develop and maintain detection documentation, playbooks, and operational handoff procedures.
• Collaborate with SOC, Data Onboarding, Automation, and Incident Response teams.
• Support Detection-as-Code initiatives, CI/CD pipelines, and content lifecycle management.

Skills

Microsoft Sentinel

Defender XDR

KQL

Threat Hunting

Detection Engineering

MITRE ATT&CK

Tools

Python

PowerShell

Azure Data Explorer

SOAR Automation

Detection-as-Code

Job description

Location: Any Capgemini Location / Hybrid

Primary Skills

• Microsoft Sentinel
• Defender XDR
• KQL
• Detection Engineering
• Threat Hunting

Secondary Skills

• Python
• PowerShell
• MITRE ATT&CK
• Azure Data Explorer
• Detection-as-Code
• SOAR Automation

Job Description

We are looking for a skilled Detection Engineer to design, develop, validate, and optimize advanced threat detections across enterprise environments. The ideal candidate will have strong expertise in Microsoft Sentinel, Defender XDR, KQL, and Threat Hunting, with hands-on experience building detection use cases, analytics rules, and security monitoring capabilities.

Key Responsibilities

• Design, develop, and maintain detection use cases, analytics rules, hunting queries, dashboards, and correlation logic.
• Create and tune detections in Microsoft Sentinel and Defender XDR.
• Translate threat intelligence, incident findings, red/purple team outputs, and emerging threats into actionable detection content.
• Perform threat hunting and identify opportunities to improve detection coverage.
• Map detections to the MITRE ATT&CK framework and identify coverage gaps.
• Validate and test detections using attack simulations, threat emulation, and historical data analysis.
• Reduce false positives through tuning, enrichment, suppression logic, and behavioral analysis.
• Develop and maintain detection documentation, playbooks, and operational handoff procedures.
• Collaborate with SOC, Data Onboarding, Automation, and Incident Response teams.
• Support Detection-as-Code initiatives, CI/CD pipelines, and content lifecycle management.

Required Skills

6+ years of experience in Detection Engineering, Threat Hunting, or Security Analytics.

• Strong hands-on experience with Microsoft Sentinel and Defender XDR.
• Expert knowledge of KQL (Kusto Query Language).
• Strong scripting skills in Python and PowerShell.
• Experience with SIEM/XDR rule creation, tuning, and validation.
• Deep understanding of MITRE ATT&CK and threat-informed defense.
• Experience with detection engineering, content lifecycle management, and analyst workflows.
• Knowledge of Windows, Linux, Active Directory, Entra ID, Azure, Microsoft 365, cloud, network, and endpoint security.