Security Detection & Automation Engineer

Role overview Develop and operate security detections and controlled automation that help identify attacker behavior and control failures. The work spans detection logic, telemetry quality, validation, and operational workflows, in close coordination with security operations and incident response teams.

Responsibilities - Create, test, tune, and maintain SIEM or EDR detections, reducing noisy alerts while preserving intended coverage. - Check that required security telemetry is available and reliable; investigate missing fields and broken dependencies with their owners. - Record detection logic, assumptions, limitations, test evidence, ownership, runbooks, and expected analyst actions. - Use incident findings and threat intelligence to identify detection gaps and improve alert context and operational handoffs. - Build and monitor low-risk workflows for triage, enrichment, routing, evidence collection, and reporting, with appropriate access controls, logging, failure handling, and rollback. - Diagnose detection or workflow failures, follow approved recovery procedures, and escalate critical gaps or unsafe changes.

Requirements - Ability to translate an attacker behavior or control failure into detection logic and explain its data needs, limits, and intended response. - Experience with a SIEM or EDR platform such as Elastic Security or Microsoft Defender, or a comparable tool. - Practical familiarity with detection formats such as Sigma or YARA and mapping detections to MITRE ATT&CK. - Experience using scripting, a SIEM query language, or SOAR tools to support integrations and workflows. - Ability to query and correlate security events, check data quality, and build repeatable tests for suspicious and benign activity. - Skill in investigating noisy alerts and tuning rules without losing necessary coverage; clear technical documentation is also required.

Nice to have - Experience with detection-as-code, version control, peer review, automated testing, or continuous integration. - Security training or certifications, or experience in financial technology, trading, payments, or digital assets.

Benefits and work setup - Remote work is available. - Annual provisions include 20 paid vacation days and 10 paid sick days, plus public holidays under the applicable holiday policy. - Budgets are offered for medical care, professional education, language learning, and wellness.