Detection Engineer: Splunk SIEM & MITRE ATT&CK Expert

The Boston Consulting Group GmbH; Lisboa; Presencial; EUR 70 000 - 110 000; Tempo integral

Resumo da oferta

Boston Consulting Group GmbH in Portugal is seeking an experienced Detection Engineer to fortify its security posture by building high-confidence detections grounded in real threat telemetry.

You'll translate threat intel and offensive findings into production-ready detections across a large enterprise, collaborate with CSIRT, Security Engineering, and providers, and continually validate against evolving adversary techniques.

Qualificações

• Experience building production detection rules across enterprise security platforms.
• Strong knowledge of MITRE ATT&CK and translating techniques into detections.
• Proficient in Splunk SPL or similar query languages for security.
• Understanding of offensive security and validating detections via purple testing.
• Analytical mindset with ability to decide under evolving data.

Responsabilidades

• Collaborate with Detection Engineering, CSIRT, Security Engineering, and providers to develop and improve detection content.
• Develop and maintain detection rules using SIEM, EDR, and other platforms.
• Translate red team findings and threat intel into production-ready detections.
• Validate detections against telemetry before deployment.
• Tune content using feedback to reduce false positives.
• Contribute to ATT&CK coverage by identifying gaps.
• Develop investigation guidance and runbooks for triage.
• Partner with Security Engineering to ensure telemetry supports detection development.
• Maintain detection documentation and lifecycle activities.

Conhecimentos

Detection rules

MITRE ATT&CK

Splunk SPL

Offensive security

Analytical thinking

Cross-team collaboration

Telemetry understanding

Ferramentas

Splunk

EDR

SIEM

Descrição da oferta de emprego

Boston Consulting Group GmbH in Portugal is seeking an experienced Detection Engineer to fortify its security posture by building high-confidence detections grounded in real threat telemetry.

You'll translate threat intel and offensive findings into production-ready detections across a large enterprise, collaborate with CSIRT, Security Engineering, and providers, and continually validate against evolving adversary techniques.