SOC Detection Specialist

Powerdata Group Consulting; United States; À distance; USD 120 000 - 180 000; Plein temps

Résumé du poste

Powerdata Group Consulting seeks a seasoned security operations professional to lead threat detection engineering in a remote role. You will design and tune SIEM/EDR content, build SOAR playbooks, and validate alerts while supporting incident response and data onboarding.

You will also apply threat modelling using STRIDE and ATT&CK, and integrate threat intelligence feeds to strengthen monitoring across cloud and on-prem environments. Experience with AI security monitoring is highly valued.

Qualifications

• 1+ detection engineering across two enterprise SIEM platforms.
• Experience developing detections for SIEM, SOAR and EDR with automation.
• Practical threat modelling using STRIDE, ATT&CK and related methodologies.
• Experience integrating threat intelligence feeds into monitoring.

Responsabilités

• Develop SIEM use cases and content to improve detection coverage.
• Tune detection rules and validate alert quality.
• Engineer EDR detections and SOAR playbooks for automated responses.
• Support incident response efforts and data-source onboarding.
• Participate in threat modelling and intelligence integration activities.
• Collaborate in Agile and ITIL-aligned environments.

Connaissances

AI threat modelling

Prompt injection detection

AI model abuse detection

AI data leakage monitoring

Adversarial AI activity detection

Security monitoring of AI platforms

Threat detection use cases

Detection content engineering

SIEM/EDR/SOAR integration

Incident response automation

Outils

Microsoft Sentinel

Microsoft Defender XDR

Splunk

QRadar

CrowdStrike

Palo Alto Cortex XDR

Description du poste

This is a remote position. Location: Canberra, Australian Capital Territory (ACT) Security Clearance: Baseline Clearance

Threat Detection Engineering

• SIEM use case development and detection content creation
• Detection rule development and tuning
• EDR detection engineering
• SOAR playbook development
• Alert validation processes

Threat Modelling

• STRIDE
• MITRE ATT&CK
• Attack path analysis
• Detection coverage assessment
• Gap analysis

Threat Intelligence

• Threat intelligence integration and management
• Research into emerging threats
• Intelligence sharing across infrastructure and architecture teams

Security Operations

• SOC operations
• Incident response support
• Detection engineering lifecycle management
• Data source onboarding
• ITIL and Agile environments

AI Security (Important New Requirement)

The RFQ specifically calls for experience in:

• AI threat modelling
• Prompt injection detection
• AI model abuse detection
• AI-related data leakage monitoring
• Adversarial AI activity detection
• Security monitoring of AI platforms, services and agents

A strong candidate would typically have:

• 5+ years in SOC, Detection Engineering, Threat Hunting, or Cyber Security Operations
• Hands-on experience with platforms such as:
• Microsoft Sentinel
• Microsoft Defender XDR
• Splunk
• QRadar
• CrowdStrike
• Palo Alto Cortex XDR
• Experience developing KQL, SPL, Sigma, YARA, or similar detection content
• Strong understanding of MITRE ATT&CK
• Experience integrating threat intelligence feeds
• Good documentation and stakeholder engagement skills

Evaluation Themes to Address in a Submission

• Development of threat detection use cases and rules.
• SIEM/EDR content engineering and tuning.
• Threat modelling expertise using STRIDE and ATT&CK.
• Threat intelligence integration and analysis.
• Experience supporting incident response activities.
• Security monitoring of cloud and on-premises environments.
• AI security and emerging threat detection capabilities.
• Working within Agile and ITIL environments.

Requirements

Essential criteria

• 1.Detection Engineering and SIEM Expertise - Demonstrated experience developing detection content across at least two enterprise SIEM platforms (e.g. Splunk, Microsoft Sentinel, QRadar, Elastic).
• 2.Threat Detection and Response Capability - Experience developing and implementing detections across SIEM, SOAR and EDR platforms, including incident response automation and playbook development.
• 3.Threat Modelling and Threat Intelligence - Practical experience conducting threat modelling using recognised methodologies (e.g. STRIDE, PASTA, ATT&CK) and translating outcomes into detection and monitoring requirements, supported by a strong understanding of the cyber threat intelligence lifecycle.
• 4.AI Security Monitoring - Experience identifying, assessing and developing monitoring controls for AI-related security risks, including enterprise AI platforms such as Microsoft Copilot or Azure AI.
• 5.Cyber Security Operations Experience - Minimum five years' experience in cyber security operations, supported by strong organisational, communication and stakeholder engagement skills.

Desirable criteria

• 1.Sigma Rule Development - Experience developing or using Sigma detection rules and translating detections between security platforms.
• 2.Advanced AI Security Knowledge - Familiarity with AI security frameworks and guidance, including ASD/ACSC, NIST, MITRE ATLAS and OWASP LLM Top 10. Relevant industry certifications such as GIAC, SANS, CISSP, GCIA, GCIH or equivalent cyber security qualifications.
• 3.EDR Platform Expertise - Experience with enterprise EDR technologies such as CrowdStrike, Microsoft Defender for Endpoint and Carbon Black.
• 4.Automation and Scripting - Proficiency in scripting languages such as Python and Bash to support detection engineering and security automation activities.

Job ID: LH-07702