Role: SIEM & Detection Logic Engineering Lead

Location: London, Bank - 3 days in office.

Details:

Initial 6 month contract, with guaranteed conversion to perm within that period. Perm salary: up to £120k base + bonus (VP Level) Initial contract rate: TBC

Requirements:

• Proven experience leading and developing a Detection Engineering, Threat Detection, or Cyber Security Operations team.
• Extensive experience designing, implementing, and tuning security detection logic across SIEM, EDR, cloud, and identity platforms.
• Strong hands-on expertise with Microsoft Sentinel and KQL (or comparable SIEM technologies such as Splunk/Elastic).
• Deep understanding of adversary tactics, techniques, and procedures (TTPs) and the MITRE ATT&CK framework.
• Experience translating threat intelligence, incident findings, and red/purple team outcomes into actionable detection use cases.
• Demonstrated ability to build and maintain detection engineering roadmaps, standards, and governance processes.
• Experience measuring and improving detection coverage, alert fidelity, and operational effectiveness.
• Strong knowledge of endpoint, identity, network, and cloud security controls and telemetry sources.
• Experience working closely with SOC, Incident Response, Threat Hunting, Threat Intelligence, and Security Architecture teams.
• Ability to mentor, coach, and develop detection engineers and analysts within a high-performing team environment.
• Strong stakeholder management and communication skills, with experience presenting to senior technical and business audiences.
• Experience with automation and detection-as-code methodologies is highly desirable.
• Knowledge of Azure, Microsoft Defender XDR, Entra ID, and cloud-native security monitoring capabilities preferred.
• Proficiency in scripting or programming languages such as Python, PowerShell, or similar is desirable.
• Relevant certifications such as CISSP, GCIH, GCDA, GCIA, or Microsoft Security certifications are advantageous.