2 months ago
Lisbon, PortugalStaff+
Responsibilities
- Design, develop, maintain, and continuously improve high-confidence detections across SIEM, EDR, and enterprise security platforms.
- Define detection engineering standards, development practices, and quality expectations across the detection lifecycle.
- Translate threat intelligence, offensive security findings, and ATT&CK coverage analysis into prioritized engineering initiatives.
- Lead complex detection engineering projects and provide technical leadership and mentoring while remaining hands-on.
- Validate detections through purple team exercises, adversary emulation, atomic testing, and continuous testing.
- Establish measurable approaches to detection quality, coverage, and effectiveness using operational feedback.
- Guide Detection-as-Code practices, engineering automation, and scalable detection development workflows.
- Collaborate with Security Operations, Security Engineering, Infrastructure, Threat Intelligence, CSIRT, and Offensive Security teams.
Requirements
- Extensive experience designing, developing, and maintaining production detection content across enterprise SIEM, EDR, and security monitoring platforms.
- Deep knowledge of MITRE ATT&CK, adversary tradecraft, and threat-informed detection engineering.
- Advanced expertise with Splunk SPL and complex detection logic across diverse data sources.
- Experience defining engineering standards, reviewing detection quality, and establishing repeatable detection practices.
- Demonstrated ability to lead technical initiatives, mentor engineers, and provide technical direction while remaining actively engaged in hands-on engineering.
- Experience validating detections through purple teaming, adversary emulation, atomic testing, or similar evidence-based approaches.
- Ability to balance detection coverage, operational efficiency, and measurable security outcomes.
Tech Stack
Splunk
Categories
