Security Detection & Automation Engineer

JustMarkets; United States; Hybrid; USD 101,000 - 146,000; Full time

Benefits offered by this job

20 paid vacation days per year

10 paid sick leave days per year

Public holidays as per the company's P

Public holidays as per the company's '

Job summary

JustMarkets is seeking a Security Detection & Automation Engineer to join our team in a full-time role focused on building and tuning SIEM/EDR detections, validating telemetry, and developing low-risk automations for triage and reporting. You will collaborate with SOC and IR to enhance telemetry and runbooks while maintaining thorough documentation.

The ideal candidate has hands-on experience with Elastic Security or Microsoft Defender, SIEM/EDR, and detection-content formats like Sigma or YARA.

Qualifications

• Translate attacker behaviour or control-failure scenarios into working SIEM/EDR detection logic with signal/data requirements and analyst actions.
• Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
• Proficiency with Sigma, YARA or other detection-content formats and mapping detections to MITRE ATT&CK techniques.
• Experience with a scripting language or SIEM query language or SOAR tooling for integrations/workflows.
• Write and troubleshoot security-data queries; validate fields, timestamps, source coverage and data quality for detections.
• Design repeatable tests for suspicious and benign activity and retain evidence of coverage.
• Investigate noisy alerts and tune logic without removing coverage; justify changes with evidence.
• Use threat intelligence to improve detection content and identify gaps.
• Document rules, owners, dependencies, validation results and runbooks for maintenance.
• Build and troubleshoot API-based integrations and low-risk security workflows with proper controls.

Responsibilities

• Develop, test, tune and maintain SIEM/EDR detections for priority attacker behaviours and control failures.
• Validate telemetry availability and quality; resolve missing fields and broken dependencies.
• Document detection logic, assumptions, owners, evidence, runbooks and analyst actions.
• Support detection-gap analysis after incidents and updates; improve telemetry and runbooks.
• Build low-risk automations for triage, enrichment, routing, evidence collection and reporting.
• Monitor reliability of detections and workflows; diagnose failures and maintain docs.
• Provide operational support for detection-platform components and share knowledge within the team.
• Approve rule logic and tuning changes within delegated authority; escalate deviations appropriately.
• Escalate missing logs, high-impact failures, or unsafe workflows to the detection manager.

Skills

Elastic Security

Microsoft Defender

SIEM/EDR

Sigma

YARA

SOAR tooling

APIs

Scripting

Tools

Sigma

YARA

SOAR tooling

APIs

Job description

Security Detection & Automation Engineer

Europe

We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.

Responsibilities

• Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
• Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.
• Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
• Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.
• Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
• Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
• Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.
• Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; *escalate deviations* to the detection manager and submit response automations and integrations through the required approval path.
• Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.

Requirements

• Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
• Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
• Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
• Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
• Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
• Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
• Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
• Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
• Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
• Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
• Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and diagnose critical gaps with actionable evidence.

Will be a plus

• Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
• Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)