Detection Engineer: SIEM & Threat Detection

Boston Consulting Group (BCG); Lisboa; Presencial; EUR 60 000 - 90 000; Tempo integral

Resumo da oferta

Boston Consulting Group is seeking a Detection Engineer to strengthen its global detection capabilities. You will develop high-confidence detections, translating threat intelligence into production-ready content to bolster the security posture across a large enterprise.

Working within Security Operations, you will collaborate with CSIRT, Security Engineering and our MSP to validate detections against telemetry, improve fidelity, and ensure reliable, measurable outcomes in a complex environment.

Qualificações

• Proven experience developing and maintaining production detection rules across enterprise security platforms.
• Strong knowledge of MITRE ATT&CK and translating adversary techniques into detections.
• Advanced proficiency with Splunk SPL or equivalent security query languages.
• Experience validating detections through purple teaming or atomic testing.
• Analytical mindset with ability to decide under evolving information.
• Ability to collaborate with SOC, Incident Response, Engineering and other teams.

Responsabilidades

• Develop high-confidence detections to identify evolving cyber threats.
• Translate threat intelligence into production-ready detections.
• Collaborate with Detection Engineering, CSIRT, Security Engineering and MSP.
• Develop and maintain detection rules using SIEM, EDR, and other platforms.
• Validate detections against telemetry before deployment.
• Maintain detection documentation and lifecycle following engineering standards.

Conhecimentos

Splunk SPL

MITRE ATT&CK

Threat detection engineering

Cross-team collaboration

Analytical reasoning

Ferramentas

Splunk

EDR

SIEM

Descrição da oferta de emprego

Boston Consulting Group is seeking a Detection Engineer to strengthen its global detection capabilities. You will develop high-confidence detections, translating threat intelligence into production-ready content to bolster the security posture across a large enterprise.

Working within Security Operations, you will collaborate with CSIRT, Security Engineering and our MSP to validate detections against telemetry, improve fidelity, and ensure reliable, measurable outcomes in a complex environment.