Detection Engineer (SIEM/EDR)

Location: Europe; remote work opportunity

What you will do

• Develop, test, tune, maintain, and approve SIEM/EDR detection logic for attacker behaviours and control failures.
• Validate telemetry quality, resolve missing fields and broken dependencies, and monitor detection and workflow reliability.
• Document rules, assumptions, limitations, owners, dependencies, test evidence, runbooks, and expected analyst actions.
• Work with SOC and incident response teams on detection-gap analysis, threat-intelligence updates, alert context, runbooks, and handoffs.
• Build and validate low-risk automations for triage, enrichment, routing, evidence collection, and reporting with access controls, logging, failure handling, and rollback.
• Provide operational support, diagnose failures, escalate critical gaps, and share knowledge within the team.

Requirements

• Ability to translate attacker-behaviour or control-failure scenarios into working SIEM or EDR detection logic, including signals, required data, assumptions, limitations, and analyst actions.
• Experience with Elastic Security, Microsoft Defender, or similar SIEM/EDR platforms and security workflow tools.
• Practical use of Sigma, YARA, or other detection-content formats, with mapping to MITRE ATT&CK techniques.
• Experience with a scripting language, SIEM query language, or SOAR tooling; no particular scripting language is required.
• Ability to write and troubleshoot security-data queries, correlate events, and verify fields, timestamps, source coverage, and data quality.
• Ability to design repeatable tests for suspicious and benign activity, interpret results, and retain detection-coverage evidence.
• Experience investigating noisy alerts, tuning logic or exceptions without removing required coverage, and using analyst feedback and evidence to justify changes.
• Ability to use incident findings, threat intelligence, and attacker techniques to improve detections and identify gaps.
• Ability to build and troubleshoot API-based integrations and low-risk workflows with appropriate access, logging, testing, failure handling, and rollback controls.
• Ability to diagnose rule, telemetry, and workflow failures, distinguish local issues from upstream dependencies, and escalate critical gaps with actionable evidence.

Nice to have

• Detection-as-code, version control, peer review, automated rule testing, or continuous-integration practices.
• Relevant security training or certifications, or experience in fintech, trading, payments, or crypto environments.

Culture & Benefits

• Full-time role with an opportunity to work remotely from Europe.
• 20 paid vacation days and 10 paid sick leave days per year.
• Public holidays according to the approved company holiday list.
• Medical, professional education, language learning, and wellness budgets.