Cyber SOC Detection Engineer Lead

HSBC Holdings plc; Kraków; Presencial; PLN 249.000 - 374.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Car allowance

Multisport card

Private medical care

Life insurance

Home office setup reimbursement

Descripción de la vacante

HSBC Holdings plc in Kraków is seeking a Cyber SOC Detection Engineer to build, manage and optimise high-fidelity detections that protect customers and services at enterprise scale. You will work hands-on on detection content, telemetry, and validation, partnering with SOC Operations and Incident Response to ensure detections are actionable and resilient.

The role involves owning a detection domain (identity, endpoint or cloud), setting content standards, mapping to MITRE ATT&CK, and delivering

Formación

• Demonstrable experience delivering production-grade detections in a SOC or detection engineering function within a large complex environment.
• Strong understanding of attacker tactics, defensive telemetry across endpoint, identity, cloud and network.
• Disciplined lifecycle management including tuning, documentation and release practices.

Responsabilidades

• Build detections from threat intelligence, incident learnings, purple team outcomes and hypothesis-driven hunting.
• Own the detection lifecycle from intake and design through build, test, tuning, measurement, documentation and retirement decisions.
• Define and apply detection quality standards including severity, telemetry needs, triage guidance and response actions.
• Improve detection performance by reducing false positives and improving time-to-detect through tuning and data quality improvements.
• Validate detections through simulation, adversary emulation, log replay and regression testing after schema or platform changes.
• Partner with SOC, Incident Response, Threat Intel and platform teams to operationalise detections.

Conocimientos

AI in SOC

Detections engineering

Threat understanding

Detection logic

KQL/SPL/SQL

Quality gates

Windows telemetry

Git/version control

Herramientas

Git

Descripción del empleo

Some careers shine brighter than others.

If you’re looking for a career that will help you stand out, join HSBC, and fulfil your potential. Whether you want a career that could take you to the top, or simply take you in an exciting new direction, HSBC offers opportunities, support and rewards that will take you further.

Your career opportunity

HSBC is looking for a Cyber SOC Detection Engineer to build, manage and continuously optimise high-fidelity cyber detections that protect our customers and services at enterprise scale. This is a hands‑on engineering role focused on detection content telemetry and validation, partnering closely with SOC Operations and Incident Response to ensure detections are actionable measurable and resilient.

What you’ll do

• Build detections from threat intelligence incident learnings purple team outcomes and hypothesis‑driven hunting
• Own the detection lifecycle from intake and design through build test tuning measurement documentation and retire or replace decisions
• Take ownership of a defined detection domain such as identity endpoint or cloud and set content standards and coverage strategy
• Map detections to MITRE ATT&CK maintain coverage views and close detection gaps for priority threats and critical assets
• Define and apply detection quality standards including severity fidelity telemetry needs triage guidance and response actions
• Improve detection performance post‑deployment by reducing false positives and improving time‑to‑detect through tuning enrichment and data quality improvements
• Validate detections through simulation or adversary emulation log replay and regression testing after schema or platform changes
• Partner with SOC Incident Response Threat Intel and platform teams to operationalise detections and strengthen response readiness

What you need to have to succeed in this role

• Use AI within SOC workflows across detection engineering triage and response actions
• Bring demonstrable experience delivering production‑grade detections in a SOC or detection engineering function within a large complex environment
• Apply strong understanding of attacker tactics and techniques and defensive telemetry across endpoint identity cloud and network
• Write optimise and troubleshoot detection logic including query or rule development correlation and enrichment
• Use KQL SPL SQL or equivalent to build and tune correlation or sequence detections beyond indicator‑only rules
• Operate detections with quality gates including testing evidence peer review release notes and rollback practices
• Apply strong understanding of Windows and identity telemetry such as authentication privilege and process execution plus at least one cloud control plane
• Apply disciplined lifecycle management including tuning measurement documentation and retirement supported by Git or equivalent version control and structured release management

What we offer

The pay range for this role is 22317 PLN - 33475 PLN monthly, gross.
Additional car allowance in the amount of 4786 PLN monthly, gross.

Variable pay is discretionary, but influenced by Group performance, business/function performance and individual performance.

We offer a comprehensive and competitive package of benefits covering healthcare, family friendly leaves, pension and life assurance, as well as many other benefits to support your wellbeing.

• Additional bonuses for recognition awards
• Multisport card
• Private medical care
• Life insurance
• One-time reimbursement of home office set-up (up to 800 PLN).
• Cafeteria platform
• Employee assistance program
• Additional contributions to PPK scheme
• Corporate parties & events
• CSR initiatives
• Nursery discounts
• Financial support with trainings and education
• Social fund
• Flexible working hours
• Free parking

If your CV meets our criteria, you should expect the following steps in the recruitment process:

• Online behavioural test (for external candidates only)
• Telephone screen (for external candidates only)
• Interview with the hiring manager

Being open to different points of view is important for our business and the communities we serve. At HSBC, we’re dedicated to creating diverse and inclusive workplaces. We are committed to removing barriers and ensuring careers at HSBC are inclusive and accessible for everyone to be at their best.
If you have a need that requires accommodations or changes during the recruitment process, please let us know.