Hybrid Cyber Threat Detection Engineer MITRE ATT&CK Expert

Bosch; Warszawa; Hybrid; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work with flexible hours

Private medical care

Life insurance

Cafeteria system

Job summary

Bosch in Warsaw seeks a seasoned detection engineer to analyze CTI, emulate adversaries, and tune detection rules to strengthen security posture. You will collaborate with SOC and IR teams to streamline alerts and reduce false positives while applying MITRE ATT&CK mappings and automation with Python, PowerShell, or Bash.

The role requires deep CTI/SOC familiarity, strong English, and experience in automating detection workstreams within a multinational tech environment.

Qualifications

• Professional Experience: Multiple years of experience in detection engineering/content development, threat hunting, or offensive security.
• Technical Expertise: Deep expertise in the MITRE ATT&CK framework, mapping hypotheses to adversary TTPs.
• Programming & Automation: Proficient in scripting/automation languages (Python, PowerShell, Bash) and query languages (SQL, Splunk SPL).
• Certifications (Strong Plus): Offensive security certifications (e.g., OSCP, OSEP, CRTO, GXPN, GPEN, GCIH or GIAC).
• Threat Intelligence & SOC: Familiarity with CTI/SOC Analyst concepts is a strong asset.
• Soft Skills & Language: Analytical, structured mindset; fluent English; German or other European languages are a plus.

Responsibilities

• Visibility & Detection Gap Analysis: Analyze CTI, attack surfaces, and detection landscape to identify gaps.
• Adversary Emulation: Perform adversary emulation to validate and improve detection coverage.
• Rule Development & Tuning: Develop, test, and tune high-fidelity detection rules and preventive controls.
• SOC Collaboration: Work with SOC and incident response to streamline alert triage and reduce false positives.

Skills

Detection engineering

Threat hunting

Offensive security

MITRE ATT&CK

Python

PowerShell

Bash

SQL

Splunk SPL

Tools

MITRE ATT&CK framework

Job description

Bosch in Warsaw seeks a seasoned detection engineer to analyze CTI, emulate adversaries, and tune detection rules to strengthen security posture. You will collaborate with SOC and IR teams to streamline alerts and reduce false positives while applying MITRE ATT&CK mappings and automation with Python, PowerShell, or Bash.

The role requires deep CTI/SOC familiarity, strong English, and experience in automating detection workstreams within a multinational tech environment.