SOC Detection Engineer
Core
Create, test, deploy, and continuously improve SIEM detection rules to increase the efficiency and accuracy of incident detection and response.
Role type
SOC Detection Engineer
Builds
SIEM detection rules and automated investigation steps
Domain
Cybersecurity / SIEM / Threat Detection
Deliverable
production ML models
Required skills
SIEM platforms, security query languages, MITRE ATT&CK mapping, security log sources (EDR, Windows, identity, cloud, network), data analytics, scripting (Python, PowerShell, Bash), offensive security techniques
Preferred skills
detection-as-code, version control (Git), SOAR and security automation concepts
Responsibilities
Create and deploy SIEM detection rules aligned with MITRE ATT&CK; Validate detections through testing and attack simulation; Review and tune existing detections to improve true positive rates and reduce false positives; Identify gaps in detection coverage and prioritize new use cases; Ensure security telemetry is complete and accurate; Automate detection, enrichment, and investigation steps; Work with SOC operations, incident response, threat intelligence, and SOAR teams; Maintain documentation of detection logic and coverage mapping
Seniority
Mid-level, hands-on IC
