Senior Detection Engineer — Detection-as-Code

F5; Warszawa; On-site; PLN 180,000 - 260,000; Full time

Job summary

F5 is seeking a seasoned Security Engineer to design and maintain advanced detections, aligned with MITRE ATT&CK, across SIEM/EDR platforms. You will collaborate with Incident Response, Threat Intelligence, and Logging teams to translate evolving threats into actionable content.

The role emphasizes automation, rigorous testing, and on-call coverage, with travel up to 5% as needed. A strong foundation in detections and AI-enabled security is essential.

Qualifications

• Bachelor's degree or equivalent practical experience in information security or related field.
• 5+ years of cybersecurity, security engineering, detection engineering, or related roles.
• Experience developing, tuning, or maintaining detections in SIEM/EDR/log analytics.
• Scripting/automation using Python, PowerShell, SQL, KQL, or SPL.
• Strong understanding of attacker techniques and MITRE ATT&CK.
• Excellent analytical, problem-solving, and cross-functional communication skills.

Responsibilities

• Develop and maintain custom detections with Detection-as-Code practices, including version control, reviews, testing, and CI/CD workflows.
• Map telemetry/detections to adversary behaviors and MITRE ATT&CK to improve coverage.
• Collaborate with Incident Response, Threat Intelligence, Logging Engineering, and security platform teams to translate threats into actionable content.
• Tune detections via adversary emulation, purple-team exercises, and production feedback to reduce false positives.
• Automate detection engineering workflows and alert enrichment to improve efficiency and scalability.
• Onboard new log sources and establish coverage across environments and technologies.
• Create and maintain detection docs, runbooks, coverage assessments, and standards; participate in on-call rotation.
• Define detection strategy for AI/agentic systems and explore AI to accelerate workflows.

Skills

5+ years in cybersecurity

SIEM/EDR/detection engineering

Python/PowerShell/SQL/KQL

MITRE ATT&CK framework

cross-functional collaboration

Education

Bachelor's degree in Information Security or related field

Tools

SIEM

EDR

Splunk

Microsoft Sentinel

CrowdStrike

Elastic

Job description

F5 is seeking a seasoned Security Engineer to design and maintain advanced detections, aligned with MITRE ATT&CK, across SIEM/EDR platforms. You will collaborate with Incident Response, Threat Intelligence, and Logging teams to translate evolving threats into actionable content.

The role emphasizes automation, rigorous testing, and on-call coverage, with travel up to 5% as needed. A strong foundation in detections and AI-enabled security is essential.