Senior Threat Detection Engineer

About the role

A hands-on senior position covering the full detection lifecycle, from hunting unknown threats to building rules and keeping log pipelines healthy, with an initial spell on the incident response rotation.

What you will do

• Create, test and refine detection rules written in KQL and shipped through a GitOps pipeline with automated deployment
• Map coverage against MITRE ATT&CK, spot gaps and prioritise investment using the threat model
• Assess community and vendor rule releases and choose which to adopt, adjust or ignore
• Reduce alert noise through tuning, retire stale rules and track detection quality metrics
• Join the incident response rotation for triage, scoping, containment and investigation, then feed lessons into new detections

What they look for

• Senior, hands-on experience across the whole detection lifecycle
• Strong KQL skills and familiarity with GitOps workflows for rules as code
• Knowledge of MITRE ATT&CK and threat modelling for coverage decisions
• Experience hunting across cloud, SaaS, identity and endpoint telemetry
• Ability to lead investigations and write runbooks others can follow
• Comfort owning log pipeline health alongside detection content