Detection Engineer — Threat-Led SIEM & MITRE ATT&CK

Boston Consulting Group; Lisboa; On-site; EUR 55,000 - 90,000; Full time

Job summary

Boston Consulting Group's Security Operations team seeks a Detection Engineer to build high-confidence detections across SIEM, EDR, and enterprise security platforms, translating threat intelligence into production-ready rules. You will collaborate with CSIRT, Security Engineering, and managed security providers to validate telemetry, reduce false positives, and strengthen BCG's global security posture.

The role requires deep technical depth, threat knowledge, and disciplined execution to

Qualifications

• Experience building production detection rules for enterprise SIEM/EDR.
• Strong knowledge of MITRE ATT&CK and translating techniques into detections.
• Proficiency with Splunk SPL or similar query languages.
• Experience validating detections with purple teaming or testing.
• Analytical mindset and decision-making under evolving information.
• Experience collaborating across Security Operations, Incident Response, and Engineering.

Responsibilities

• As a Detection Engineer, build high-confidence detections to identify evolving cyber threats.
• Translate threat intelligence and offensive findings into production-ready detections.
• Collaborate with CSIRT, Security Engineering, and managed security provider to improve content.
• Develop, validate, and maintain detections using SIEM, EDR, and other platforms.
• Tune content to reduce false positives while preserving fidelity.
• Contribute to ATT&CK coverage by identifying detection gaps and addressing them.
• Develop investigation guidance and runbooks for consistent triage across teams.
• Ensure telemetry supports effective detection development.

Skills

Detections engineering

Threat intelligence

MITRE ATT&CK

Splunk SPL

Offensive security

Analytical thinking

Tools

Splunk SPL

Job description

Boston Consulting Group's Security Operations team seeks a Detection Engineer to build high-confidence detections across SIEM, EDR, and enterprise security platforms, translating threat intelligence into production-ready rules. You will collaborate with CSIRT, Security Engineering, and managed security providers to validate telemetry, reduce false positives, and strengthen BCG's global security posture.

The role requires deep technical depth, threat knowledge, and disciplined execution to