Detection Engineer: SIEM, BAS & Threat Intel Expert

Philips; Best; Hybrid; EUR 61,000 - 102,000; Full time

Benefits offered by this job

Hybrid working

Paid time-off

Health and wellbeing benefits

Learning and development opportunities

Job summary

Philips is seeking a Detection Engineer to join the Cyber Defense Capabilities team. You will design, implement, and validate high-fidelity detection capabilities for CSIRT, building rules, correlating data, and performing BAS against evolving threat intel and TTPs.

You will map detections to MITRE ATT&CK, integrate threat intel, automate enrichment with SOAR, and collaborate with IR and threat hunting. A strong background in SIEMs and cloud security is required.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, or a related field.
• Minimum 2 years of experience in security architecture, network security or related areas.
• Strong experience with SIEM platforms (e.g., Splunk, Sentinel).
• Proficiency in detection engineering, log parsing, and data normalization.
• Knowledge of MITRE ATT&CK and threat intel integration.
• Python or PowerShell scripting skills and cloud security exposure.

Responsibilities

• Develop, test, and maintain detection rules, signatures, and correlation logic.
• Conduct regression testing to ensure detections stay effective after updates.
• Perform BAS to validate detections against threat intel and TTPs.
• Map detection logic to MITRE ATT&CK techniques and prioritize coverage.
• Integrate threat intel feeds, IOCs, and patterns into detection workflows.
• Tune detections to reduce false positives and improve alert fidelity.
• Collaborate with IR and threat hunting, conduct purple team exercises.
• Automate enrichment, correlation, and triage with SOAR playbooks.
• Document detections, maintain repositories, and test playbooks.
• Contribute to SOC metrics like detection coverage and BAS validation.

Skills

SIEM proficiency

Threat intelligence

Purple team experience

Cloud security

Python scripting

PowerShell scripting

Education

Bachelor's degree in Cybersecurity or CS

Tools

Splunk

Microsoft Sentinel

AttackIQ

Caldera

SOAR platforms

Kubernetes

Job description

Philips is seeking a Detection Engineer to join the Cyber Defense Capabilities team. You will design, implement, and validate high-fidelity detection capabilities for CSIRT, building rules, correlating data, and performing BAS against evolving threat intel and TTPs.

You will map detections to MITRE ATT&CK, integrate threat intel, automate enrichment with SOAR, and collaborate with IR and threat hunting. A strong background in SIEMs and cloud security is required.