Threat Detection Engineer, Ekco

• At least 2 years' experience in a Detection Engineering, Threat Hunting, or SOC Analysis role with a focus on detection content development
• Strong experience with SIEM platforms (e.g. Microsoft Sentinel, Falcon Next-Gen SIEM) and EDR technologies (e.g. CrowdStrike, Defender for Endpoint, SentinelOne)
• Proficiency in building detection logic using KQL, CQL, Sigma or equivalent query languages
• A solid understanding of adversary behaviour, the cyber kill chain, and MITRE ATT&CK framework
• Practical experience analysing logs, events, and telemetry to identify detection opportunities
• Familiarity with CI/CD methodologies, version control (Git), and scripting languages such as Python or PowerShell
• Strong analytical and problem-solving skills, with the ability to break down complex attack scenarios into actionable detection strategies
• Excellent communication skills – able to clearly articulate technical detail to both technical and non-technical stakeholders
• The ability to prioritise, adapt, and remain effective in a fast-paced, service-oriented environment
• A proactive mindset with a commitment to continuous improvement and innovation

Desirable

• As a Detection Engineer, your primary objective is to design, develop, test, and maintain high-fidelity threat detection content across our Managed Detection and Response (MDR) service stack
• You will operationalise threat intelligence, close detection gaps, and contribute to the continuous improvement of our SOC's threat detection capability
• This role is pivotal in ensuring our SOC Analysts are equipped with actionable, reliable alerts to identify and respond to cyber threats effectively
• Reporting to the Head of SOC – UK, the role of Detection Engineer will play a crucial role in developing, deploying, and maintaining the Ekco MSS detection use case library
• Developing, testing, and maintaining detection logic across platforms such as Microsoft Sentinel, CrowdStrike, and Defender for Endpoint
• Writing and tuning detection rules using languages such as Kusto Query Language (KQL), Sigma, or other relevant syntax
• Continuously tuning and refining detection rules to reduce false positives and enhance detection efficacy
• Conducting threat hunts and detection gap assessments based on adversary TTPs, incident reviews, and cyber threat intelligence
• Working closely with SOC Analysts to assess detection performance and enhance rule logic based on investigation outcomes
• Participating in red and blue team exercises to validate the effectiveness of detection coverage and controls
• Collaborating with SIEM architects to establish and enforce best practices around data schema and detection logic implementation
• Supporting the configuration and improvement of SOAR playbooks to aid in alert triage, enrichment, and automated response
• Leveraging version control (e.g. , Git) and CI/CD pipelines to manage and deploy detection content at scale
• Performing validation of new or updated detection rules contributed by internal or external stakeholders
• Documenting detection logic, including rationale, associated TTPs, and investigation guidance
• Supporting compliance and audit efforts through accurate documentation and reporting of detection controls
• Collaborating with Threat Intelligence, Incident Response, and Customer Success teams to align detection coverage with the threat landscape and client risk profile