Senior Lead Cyber Detection Engineer

Key Responsibilities

Detection Engineering & Security Monitoring

• Design, develop, and tune high-fidelity detection use cases across SIEM, EDR, NDR, and cloud security platforms.
• Build detection logic mapped to MITRE ATT&CK, focusing on reducing dwell time and false positives.
• Drive Detection-as-Code practices, leveraging automation, version control, and CI/CD pipelines.
• Continuously improve use-case coverage based on threat intelligence, incidents, and red/purple team outcomes.
• Evaluate and onboard new security telemetry sources to enhance visibility.

Threat Hunting

• Lead proactive, hypothesis-driven threat hunting campaigns across endpoints, network, cloud, and identity systems.
• Investigate anomalous behaviors and identify stealthy adversary activities that bypass automated detections.
• Develop reusable hunting playbooks and analytics.
• Collaborate with Incident Response to transition hunts into confirmed incidents and detection improvements.

Threat Intelligence

• Operationalize threat intelligence (strategic, tactical, and operational) into actionable detection use cases.
• Track and profile threat actors targeting financial services / payment ecosystems.
• Integrate intelligence feeds into detection pipelines and SOC workflows.
• Produce intelligence-driven insights and advisories for stakeholders.

Leadership & Technical Oversight

• Serve as a technical lead and mentor for SOC analysts and junior detection engineers.
• Set standards for detection quality, triage effectiveness, and threat coverage.
• Partner with Red Team/Purple Team to validate detection capabilities.
• Act as an escalation point for complex investigations and advanced threat scenarios.

Automation & Engineering

• Develop scripts and tooling (Python, PowerShell, etc.) to automate detection, enrichment, and response workflows.
• Integrate with SOAR platforms to improve SOC efficiency.
• Drive telemetry normalization and data quality improvements.

Stakeholder Engagement

• Work closely with IT, Cloud, DevOps, Fraud, and Risk teams to improve enterprise visibility.
• Provide clear technical reporting and metrics to leadership.
• Support regulatory and audit requirements relevant to security monitoring.

Required Qualifications & Experience

10–15+ years of cybersecurity experience, with at least:

• 5+ years in detection engineering / threat hunting / SOC engineering
• 3+ years in a lead or senior technical role

Strong experience with:

• SIEM platforms
• EDR/XDR solutions
• Threat hunting methodologies and tooling
• Agentic AI, LLM

Deep understanding of:

• MITRE ATT&CK framework
• Adversary tactics, techniques, and procedures (TTPs)

Experience with:

• Cloud security monitoring (AWS, Azure, GCP)
• Identity threat detection (e.g., Azure AD, IAM abuse)
• Detection & Alerting Use Case Management

Strong scripting/programming skills:

• Python, PowerShell, or equivalent

Experience in financial services, fintech, or payment environments is highly preferred

Familiarity with:

• Detection engineering lifecycle
• Data analytics and log pipelines
• SOAR and automation frameworks

Preferred Certifications

• GIAC (GCFA, GCDA, GCTI, GPEN)
• CISSP, CISM
• Microsoft SC-200 / Azure security certifications
• Elastic(or equivalent SIEM certifications)

Key Competencies

• Deep technical expertise with hands-on capability
• Analytical and investigative mindset
• Strong leadership and mentoring skills
• Ability to translate intelligence into actionable detection
• Strong communication and stakeholder management
• Continuous improvement and engineering mindset

What Success Looks Like

• Measurable reduction in MTTD and false positives
• Increased detection coverage aligned to MITRE ATT&CK
• Proactive identification of previously unknown threats
• Mature, scalable Detection Engineering program
• Strong collaboration across SOC, IR, and Red Team functions