STERIA UK LIMITED
SOC Engineer Detection
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Shape the Future of Microsoft Sentinel Detection Engineering
Are you passionate about Microsoft Sentinel, KQL and building high-quality detections that help a SOC identify threats effectively?
We're looking for a Senior Detection Engineer to join our growing Aerospace, Defence & Security business. You'll play a key role in designing, developing, testing and improving detection content in Microsoft Sentinel, translating threat behaviours and security requirements into reliable analytics.
This is an opportunity to join the Detection Engineering team and help strengthen detection coverage, reduce false positives and ensure detection content remains accurate, performant and operationally useful.
As a Senior Detection Engineer, you'll own detection use cases through their lifecycle, from research and data validation through KQL development, testing, deployment, tuning and continuous improvement.
Hybrid: Farnborough 3 days per week, 2 days home based.
SC Cleared or eligible.
What You'll Be Doing:
- Design, develop and maintain Microsoft Sentinel analytics rules using KQL.
- Translate threat intelligence, attacker behaviours and operational requirements into measurable detection use cases.
- Map detection content to the MITRE ATT&CK framework and help identify gaps in detection coverage.
- Validate required log sources, schemas and field mappings before developing detection logic.
- Test detections against representative data and document expected results, limitations and test evidence.
- Tune analytics to reduce false positives while preserving detection fidelity and query performance.
- Manage detection content through peer review, controlled deployment, versioning and ongoing lifecycle maintenance.
- Work with SOC analysts, threat intelligence and platform engineers to improve detections using operational feedback.
- Support threat hunting, retrospective searches and investigations using Microsoft Sentinel and KQL.
- Contribute to detection engineering standards, governance, coverage reporting and continuous improvement.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
What you will bring:
- Strong hands-on experience with Microsoft Sentinel in a detection engineering or security engineering role.
- Advanced KQL skills, including building, troubleshooting and optimising queries across multiple data sources.
- Experience creating, testing, deploying and tuning scheduled analytics rules and other Sentinel detection content.
- A good understanding of detection engineering principles, false-positive reduction and the detection content lifecycle.
- Experience developing threat-informed use cases and mapping detections to MITRE ATT&CK tactics and techniques.
- Ability to assess log source suitability, data quality, parsing and field availability for detection requirements.
- Experience with Git-based version control, peer review and controlled deployment of detection content.
- Strong analytical, troubleshooting and documentation skills, with the ability to explain detection logic clearly.
- A collaborative approach to working with SOC analysts, threat intelligence, platform engineers and other security teams.
It would be great if you had:
- Experience building Microsoft Sentinel automation rules or Logic Apps playbooks for enrichment, triage or response.
- PowerShell, Python or similar scripting skills.
- Experience using Azure DevOps or another CI/CD platform to deploy and manage security content.
- Knowledge of Microsoft Defender XDR, Advanced Hunting or related Microsoft security services.
- Familiarity with infrastructure as code, ARM, Bicep or Terraform.
- Experience with detection validation, adversary simulation or purple-team exercises.
- Awareness of responsible AI-assisted engineering and practical uses of AI to support detection research, development or documentation.
- Relevant certifications such as Microsoft Security Operations Analyst Associate or other cyber security qualifications.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
This role offers the opportunity to influence the future direction of detection engineering within a national security-focused SOC. You'll work alongside experienced cyber professionals, develop meaningful detections and help improve how threats are identified across complex environments.
If you're an experienced Sentinel practitioner who enjoys turning security requirements and threat behaviours into effective detection logic, we'd love to hear from you.
Employment Type: Full-time
Location: Hybrid 3 days per week in Farnborough
Security Clearance Level: Eligible for SC Clearance
Internal Recruiter: Jane
Salary: Up to £60,000
Benefits: 25 days annual leave with the option to purchase 10 extra days, Health Shields, life assurance, pension.
Loved reading about this job and want to know more about us? Sopra Sterias Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the clients goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UKs most complex safety- and security-critical markets.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills