Cyber Security Engineer (Detection & Threat Hunting)

GCS Recruitment; United States; Remote; USD 161,000 - 212,000; Full time

Benefits offered by this job

Fully remote contract engagement

Long-term programme of work

Job summary

GCS Recruitment is seeking a Cyber Security Engineer (Detection Engineering & Threat Hunting) for a fully remote contract engagement. The role focuses on proactive defence, engineering-led security operations, and AI-enabled capabilities in a mature cloud-first environment.

You’ll design detections, automate responses, hunt for emerging threats, and collaborate with stakeholders across technology and business to raise security maturity in a global enterprise.

Qualifications

• Extensive hands-on experience in Security Engineering, Security Operations, Detection Engineering, Threat Hunting or Incident Response.
• Strong hands-on experience with modern SIEM and/or XDR technologies.
• Expertise building/d tuning detections using KQL, SPL, or CrowdStrike Query Language.
• Experience securing and investigating threats within Microsoft 365 environments.
• Knowledge of EDR technologies across Windows and macOS.
• Scripting and automation using Python and/or PowerShell.
• Experience using AI-enabled security tooling and AI-assisted SOC capabilities.
• Understanding of MITRE ATT&CK and NIST CSF frameworks.

Responsibilities

• Design, build and optimise detections across SIEM and XDR platforms.
• Develop and tune detection logic using KQL, SPL or similar languages.
• Improve visibility across endpoints, cloud, identity and SaaS environments.
• Enhance alert quality and reduce false positives.
• Map detections to MITRE ATT&CK techniques.
• Build monitoring for AI-related threats.

Skills

SIEM/XDR engineering

Threat hunting

Detection engineering

KQL/SPL

CrowdStrike queries

Python

PowerShell

MITRE ATT&CK

Tools

EDR

Microsoft 365 Security

Cloud Security

Job description

Cyber Security Engineer (Detection Engineering & Threat Hunting)

Fully Remote | Inside IR35 | £750 per day

A leading global investment organisation is seeking an experienced Cyber Security Engineer to join its Security Operations function on a high-profile contract engagement.

This is an opportunity to work within a mature, cloud-first environment, helping to enhance threat detection, monitoring, automation, incident response, and AI-driven security capabilities. You'll play a key role in advancing security engineering practices across a modern enterprise technology estate while helping defend against increasingly sophisticated threats, including those targeting AI platforms and services.

The Opportunity

You'll join a highly skilled Security Operations team focused on proactive defence, continuous improvement, and engineering-led security operations. This is a hands-on role suited to someone who enjoys building solutions, improving detection capabilities, automating processes, and hunting for emerging threats across a complex enterprise environment.

You'll be trusted to identify security gaps, improve tooling effectiveness, and help raise the organisation's overall security maturity while working closely with stakeholders across technology and the wider business.

Key Responsibilities

Detection Engineering & Monitoring

• Design, build and optimise security detections across SIEM and XDR platforms.
• Develop and tune detection logic using technologies such as KQL, SPL or similar query languages.
• Improve visibility across endpoint, cloud, identity and SaaS environments.
• Enhance alert quality, reduce false positives, and improve operational effectiveness.
• Map detections and monitoring capabilities to MITRE ATT&CK techniques.
• Build monitoring and detection capabilities for emerging AI-related threats and adversarial AI activity.

Threat Hunting

• Conduct proactive, intelligence-led threat hunts across endpoint, identity, cloud and SaaS telemetry.
• Investigate suspicious activity and identify previously undetected threats.
• Translate hunt findings into new detections, controls and automated response capabilities.

Security Automation

• Develop automation and orchestration workflows that reduce manual effort and accelerate response.
• Use Python and/or PowerShell to automate security operations activities.
• Leverage AI-powered security capabilities to improve investigation and response efficiency.

Incident Response

• Investigate and respond to security incidents involving endpoints, cloud services, identities and collaboration technologies.
• Support containment, eradication and recovery activities.
• Conduct post-incident reviews and implement lessons learned.
• Act as a technical escalation point for complex investigations and security events.

Security Tool Optimisation

• Review and improve the effectiveness of existing security technologies.
• Identify coverage gaps, telemetry issues and integration opportunities.
• Recommend enhancements that increase value from current security investments.
• Drive continuous improvements across the security operations toolset.

Skills & Experience Required

We're keen to speak with Cyber Security Engineers who have:

• Extensive experience within Security Engineering, Security Operations, Detection Engineering, Threat Hunting or Incident Response environments.
• Strong hands-on experience with modern SIEM and/or XDR technologies.
• Expertise building and tuning detections using KQL, SPL, CrowdStrike Query Language, or similar.
• Experience securing and investigating threats within Microsoft 365 environments.
• Knowledge of Endpoint Detection & Response technologies across Windows and macOS.
• Strong scripting and automation capabilities using Python and/or PowerShell.
• Practical experience using AI-enabled security tooling and AI-assisted SOC capabilities.
• Strong understanding of attacker methodologies and frameworks such as MITRE ATT&CK and NIST CSF.
• Experience detecting threats involving AI misuse, prompt injection, AI-enabled phishing, or data leakage through AI platforms.
• Excellent communication skills and the ability to engage effectively with both technical and non-technical stakeholders.

Technical Environment

You'll work across a modern security stack that includes:

• SIEM & XDR platforms
• Endpoint Detection & Response (EDR)
• Microsoft 365 Security
• Identity Threat Detection
• Data Loss Prevention (DLP)
• Cloud Security & Cloud Posture Management
• Zero Trust architectures
• AI-enabled Security Operations capabilities

What's On Offer?

• Fully remote contract engagement
• £750 per day, Inside IR35
• Long-term programme of work
• Opportunity to work with cutting-edge AI and cyber security technologies
• Highly technical, engineering-focused role
• Immediate interview process
• Chance to make a significant impact within a globally recognised organisation

If you're a Cyber Security Engineer who enjoys building, automating, detecting and hunting within a modern security environment, we'd love to hear from you.