Senior Detection Engineer — Detection-as-Code

F5 Networks; Poland; On-site; PLN 180,000 - 300,000; Full time

Job summary

F5 Networks in Poland is seeking a Security Engineer III, Detection Engineering, to develop and tune threat-detection capabilities across SIEM and EDR platforms.

You will partner with Incident Response, Threat Intelligence, and Logging Engineering teams to translate threats into reliable detections and scalable automation, contributing to risk reduction and security operations maturity.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Engineering, or related field, or equivalent practical experience.
• 5+ years of experience in cybersecurity, security engineering, detection engineering, security operations, threat hunting, or a related discipline.
• Experience developing, tuning, or maintaining detections within a SIEM, EDR, log analytics, or security monitoring platform.
• Experience with scripting, automation, or data analysis using Python, PowerShell, SQL, KQL, SPL, or similar technologies.
• Strong understanding of attacker techniques, detection methodologies, and frameworks such as MITRE ATT&CK.
• Strong analytical, problem-solving, communication, and cross-functional collaboration skills.

Responsibilities

• Develop and maintain custom detections using Detection-as-Code practices, including version control, peer review, testing, and CI/CD deployment workflows.
• Analyze and improve detection coverage by mapping telemetry and detections to adversary behaviors and the MITRE ATT&CK framework, identifying gaps and prioritizing enhancements.
• Partner with Incident Response, Threat Intelligence, Logging Engineering, and security platform teams to translate emerging threats and telemetry into actionable detection content.
• Validate and tune detections through adversary emulation, atomic testing, purple-team exercises, and production feedback to improve signal quality and reduce false positives.
• Automate and optimize detection engineering workflows, alert enrichment processes, and operational activities to improve efficiency and scalability.
• Support onboarding of new log sources and security telemetry by collaborating with engineering and infrastructure teams to establish detection coverage across new environments and technologies.
• Create and maintain detection documentation, runbooks, coverage assessments, and technical standards while participating in an engineering on-call rotation.
• Help define detection strategy for AI and agentic systems and explore using AI to accelerate detection engineering workflows.

Skills

Analytical thinking

Problem solving

Communication

Cross-functional collaboration

Education

Bachelor's degree in Information Security, Computer Science, Engineering, or related field

Tools

CrowdStrike

Splunk

Microsoft Sentinel

Chronicle

Elastic

Git-based workflows

Job description

F5 Networks in Poland is seeking a Security Engineer III, Detection Engineering, to develop and tune threat-detection capabilities across SIEM and EDR platforms.

You will partner with Incident Response, Threat Intelligence, and Logging Engineering teams to translate threats into reliable detections and scalable automation, contributing to risk reduction and security operations maturity.