Remote Detection Engineer — MITRE-KQL Specialist

RiverSafe Limited; Remote; GBP 50,000 - GBP 70,000; Full time

Job summary

A cybersecurity firm is seeking a detection engineer to design and maintain detection content aligned with MITRE ATT&CK. The ideal candidate has strong experience with Microsoft Defender and is proficient in KQL and SPL. This role supports the full detection lifecycle and involves collaboration with teams to validate alert quality. While predominantly remote, occasional onsite travel is required. This position is also inside IR35.

Qualifications

• Strong hands-on experience with Microsoft Defender products.
• Proficiency in KQL and SPL for optimising query performance.
• Experience with detection-as-code practices using version control.

Responsibilities

• Design and develop detection content aligned to MITRE ATT&CK.
• Build and optimise detection queries using KQL.
• Support detection engineering lifecycle, including data onboarding and rule development.
• Collaborate to validate alert quality and minimise false positives.

Skills

Microsoft Defender

KQL

SPL

GitHub

MITRE ATT&CK

Job description

A cybersecurity firm is seeking a detection engineer to design and maintain detection content aligned with MITRE ATT&CK. The ideal candidate has strong experience with Microsoft Defender and is proficient in KQL and SPL. This role supports the full detection lifecycle and involves collaboration with teams to validate alert quality. While predominantly remote, occasional onsite travel is required. This position is also inside IR35.