Key Responsibilities

• Lead the onboarding of EMEA detection rules into the Global SOC, ensuring completeness and operational readiness
• Review and validate detection logic, thresholds and expected alert behaviour
• Map detection use cases to recognised threat frameworks such as MITRE ATT&CK
• Identify gaps, duplication and tuning opportunities across existing detection content
• Build clear, practical SOPs for Tier 1 and Tier 2 analysts covering triage, investigation, enrichment and decision points
• Define escalation criteria and handover conditions between regional and global teams
• Perform QA on detections and analyst handling to ensure consistent triage outcomes
• Act as the bridge between EMEA knowledge and the Global SOC, supporting walkthroughs and knowledge transfer
• Maintain strong documentation and traceability between detection logic, threat mapping and operational procedures

Ideal Experience

• Minimum four years in a SOC environment at Tier 2 or equivalent, with strong incident investigation and threat analysis experience
• Proven track record reviewing and tuning detection rules within a SIEM or monitoring platform such as Sentinel, Splunk or similar
• Hands on experience designing or documenting SOPs and analyst playbooks
• Strong understanding of attacker TTPs and mapping detections to frameworks such as MITRE ATT&CK
• Experience working across regional and global teams on standardisation or transformation initiatives
• Comfortable writing and interpreting queries for detection validation and simulation
• Financial services or other regulated environment background is desirable but not essential
• Strong communicator able to work across detection engineering, SOC operations and senior stakeholders

If you have built your career in detection and want to step out of pure alert triage into shaping how a Global SOC actually operates, this is a strong move.