Lead Cyber SOC Detection Engineer

HSBC Holdings plc; Kraków; On-site; PLN 249,000 - 374,000; Full time

Benefits offered by this job

Car allowance

Multisport card

Private medical care

Life insurance

Home office setup reimbursement

Job summary

HSBC Holdings plc in Kraków is seeking a Cyber SOC Detection Engineer to build, manage and optimise high-fidelity detections that protect customers and services at enterprise scale. You will work hands-on on detection content, telemetry, and validation, partnering with SOC Operations and Incident Response to ensure detections are actionable and resilient.

The role involves owning a detection domain (identity, endpoint or cloud), setting content standards, mapping to MITRE ATT&CK, and delivering

Qualifications

• Demonstrable experience delivering production-grade detections in a SOC or detection engineering function within a large complex environment.
• Strong understanding of attacker tactics, defensive telemetry across endpoint, identity, cloud and network.
• Disciplined lifecycle management including tuning, documentation and release practices.

Responsibilities

• Build detections from threat intelligence, incident learnings, purple team outcomes and hypothesis-driven hunting.
• Own the detection lifecycle from intake and design through build, test, tuning, measurement, documentation and retirement decisions.
• Define and apply detection quality standards including severity, telemetry needs, triage guidance and response actions.
• Improve detection performance by reducing false positives and improving time-to-detect through tuning and data quality improvements.
• Validate detections through simulation, adversary emulation, log replay and regression testing after schema or platform changes.
• Partner with SOC, Incident Response, Threat Intel and platform teams to operationalise detections.

Skills

AI in SOC

Detections engineering

Threat understanding

Detection logic

KQL/SPL/SQL

Quality gates

Windows telemetry

Git/version control

Tools

Git

Job description

HSBC Holdings plc in Kraków is seeking a Cyber SOC Detection Engineer to build, manage and optimise high-fidelity detections that protect customers and services at enterprise scale. You will work hands-on on detection content, telemetry, and validation, partnering with SOC Operations and Incident Response to ensure detections are actionable and resilient.

The role involves owning a detection domain (identity, endpoint or cloud), setting content standards, mapping to MITRE ATT&CK, and delivering