Security Detection Engineer

Salary: £68,000 - 108,000 per year

Requirements:

• We are looking for an experienced Security Detection Engineer with strong SIEM, cloud security, and automation expertise.
• We need someone who can take ownership of detection engineering and threat hunting across Azure and GCP environments.
• You should have experience building detection rules in SIEM, EDR, or cloud-native tooling.
• You should have a deep understanding of attack patterns and the MITRE ATT&CK framework.
• We need experience in SOC operations, threat analysis, or incident response.
• Hands-on Datadog experience or equivalent Sentinel/SIEM experience is required.
• Familiarity with Azure Monitor and Log Analytics is required.
• Experience with GCP Cloud Logging and Cloud Security Command Center is desirable.
• You should have SQL proficiency for querying security events and building custom reports.
• Experience with Python or PowerShell for detection automation and data enrichment is required.
• Terraform experience for automating detection deployment is essential.
• YAML experience for configuration management of detections is required.
• We need experience with Azure security architecture, including Entra ID, networking, and identity.
• GCP security basics are desirable.
• Snowflake security fundamentals are required.
• Experience with EDR platforms such as CrowdStrike, Microsoft Defender, or similar is required.
• Knowledge of financial services threats such as insider threats, data theft, and credential abuse is required.
• Understanding of regulatory requirements including DORA, FCA, and SOC2 is required.
• Familiarity with incident response frameworks is required.
• You should be comfortable working in a 24/7 on-call environment during the integration crisis period.
• We are looking for a seasoned security engineer who can operate independently in an ambiguous environment.
• Integration or M&A security experience is desirable.
• You should be comfortable with open-source and modern tech stacks.
• Snowflake and/or data platform security exposure is valuable.

Responsibilities:

• Design and implement detection rules in Datadog or an equivalent SIEM platform.
• Support UEBA to identify compromise early.
• Use Claude Code to develop detection logic and correlation rules.
• Build AI-powered anomaly detection for user behaviour and access patterns.
• Automate alert triage and prioritization.
• Integrate Datadog with Azure monitoring and GCP Cloud Logging.
• Use Terraform to automate detection deployment and configuration.
• Build CI/CD pipelines for detection rules, including version control, testing, and rollback.
• Develop custom metrics and alerting for deal-sensitive operations.
• Take ownership of detection engineering and threat hunting across Azure and GCP environments.

Technologies:

• AI
• Azure
• CI/CD
• Claude Code
• Cloud
• Datadog
• GCP
• Support
• PowerShell
• Python
• SQL
• Security
• Snowflake
• Terraform

More:

We are offering a London-based hybrid 6-month initial contract at £600-£750 per day inside IR35 for a hands-on Security Detection Engineer. This is an opportunity to work in a fast-paced environment where you will help uplift detection engineering and threat hunting across Azure and GCP, using modern security tooling, automation, and AI-assisted approaches. We are seeking someone who can operate independently and contribute to a forward-thinking security function focused on cloud monitoring, detection automation, and emerging threats.

last updated 39 week of 2026