Detection Engineer: Build & Validate SIEM Detections

Boston Consulting Group; Portugal; Presencial; EUR 60 000 - 100 000; Tempo integral

Resumo da oferta

Boston Consulting Group in Portugal is seeking an experienced Detection Engineer to bolster our continuous monitoring program. You will develop, validate, and maintain production detections across enterprise security platforms, translating threat intelligence into reliable, actionable rules.

Youll collaborate with CSIRT, Security Engineering, and our managed providers to strengthen BC G's security posture and ensure telemetry supports effective detection development.

Qualificações

• Experience developing and maintaining production detection rules across enterprise security platforms.
• Strong knowledge of MITRE ATT&CK and translating adversary techniques into effective detections.
• Advanced proficiency with Splunk SPL or similar query languages for security detection engineering.
• Understanding of offensive security techniques and experience validating detections through purple teaming, atomic testing, or similar approaches.
• Strong analytical skills and the ability to make sound technical decisions using incomplete or evolving information.
• Experience collaborating with Security Operations, Incident Response, Engineering, and other technical teams to improve detection capabilities.
• A disciplined, engineering-focused approach to producing reliable, maintainable, and well-documented detection content.

Responsabilidades

• Collaborate closely with Detection Engineering, CSIRT, Security Engineering, and our managed security provider to develop, validate, and continuously improve detection content.
• Develop and maintain detection rules using SIEM, EDR, and other enterprise security platforms.
• Translate red team exercises, penetration testing findings, and threat intelligence into production-ready detections.
• Validate detections against available telemetry before deployment to ensure accuracy and operational effectiveness.
• Tune detection content using operational feedback to improve fidelity while reducing false positives.
• Contribute to ATT&CK coverage by identifying detection gaps and developing detections to address them.
• Develop investigation guidance and runbooks that enable consistent triage across CSIRT and our managed security provider.
• Partner with Security Engineering to ensure required telemetry supports effective detection development.
• Maintain detection documentation and lifecycle activities in accordance with established detection engineering standards.

Conhecimentos

Detection rules

MITRE ATT&CK

Splunk SPL

Purple teaming

Analytical skills

Ferramentas

Splunk

EDR

Threat intelligence platforms

Descrição da oferta de emprego

Boston Consulting Group in Portugal is seeking an experienced Detection Engineer to bolster our continuous monitoring program. You will develop, validate, and maintain production detections across enterprise security platforms, translating threat intelligence into reliable, actionable rules.

Youll collaborate with CSIRT, Security Engineering, and our managed providers to strengthen BC G's security posture and ensure telemetry supports effective detection development.