Senior Detection Engineer

RiverSafe Limited; Remote; GBP 50,000 - GBP 70,000; Full time

Job summary

A cybersecurity firm is seeking a detection engineer to design and maintain detection content aligned with MITRE ATT&CK. The ideal candidate has strong experience with Microsoft Defender and is proficient in KQL and SPL. This role supports the full detection lifecycle and involves collaboration with teams to validate alert quality. While predominantly remote, occasional onsite travel is required. This position is also inside IR35.

Qualifications

• Strong hands-on experience with Microsoft Defender products.
• Proficiency in KQL and SPL for optimising query performance.
• Experience with detection-as-code practices using version control.

Responsibilities

• Design and develop detection content aligned to MITRE ATT&CK.
• Build and optimise detection queries using KQL.
• Support detection engineering lifecycle, including data onboarding and rule development.
• Collaborate to validate alert quality and minimise false positives.

Skills

Microsoft Defender

KQL

SPL

GitHub

MITRE ATT&CK

Job description

Responsibilities

• Design, develop and maintain robust detection content aligned to MITRE ATT&CK and threat-led priorities.
• Build and optimise detection queries using KQL, applying efficiency and best practices in logic construction.
• Support the full detection engineering lifecycle, including modelling, data onboarding, rule development, deployment, and iterative tuning.
• Collaborate with SOC and threat intelligence teams to validate alert quality, minimise false positives, and ensure operational relevance.

Skills

• Strong hands‑on experience with Microsoft Defender (Endpoint, Cloud, Identity) and Splunk Enterprise Security.
• Proficiency in KQL and SPL, with the ability to optimise query performance and maintain clarity of logic.
• Demonstrated experience with detection‑as‑code practices using GitHub or similar version control platforms.
• Deep understanding of MITRE ATT&CK, threat actor TTPs, and translating them into detection use cases.

This role is inside IR35 and predominantly remote, although occasional onsite travel is required