Cyber Detection Engineer

Overview

An early-career Detection Engineer role supporting the development, testing, tuning, and maintenance of cyber detection capabilities within the Security Operations Centre (SOC), working with SOC analysts, threat intelligence, incident response, and engineering teams.

What you'll do

• Support the development, testing, and maintenance of SIEM detection rules, analytics, alerts, and correlation logic.
• Assist with tuning existing detections to reduce false positives and improve detection quality.
• Investigate missed detections and support root-cause analysis activities.
• Work with SOC analysts to understand alert triage outcomes and improve detection content.
• Help onboard new log sources into monitoring platforms and validate data quality and coverage.
• Support detection use-case development using threat intelligence, MITRE ATT&CK, incident findings, and known attack techniques.
• Participate in threat hunting exercises and assist with developing new detection opportunities.
• Assist with maintaining detection engineering documentation, standards, playbooks, and testing records.
• Support development of automation workflows within SIEM, SOAR, and response platforms.
• Assist the SOC in the triage, investigation, and response of security alerts, incidents, and escalations.
• Contribute to purple-team, tabletop, and validation exercises to measure effectiveness of detections.
• Track detection performance metrics, including false positives, false negatives, detection coverage, and alert quality.
• Support continuous improvement activities following incidents, audits, and lessons learned reviews.
• Maintain flexibility to support global cybersecurity operations, including participation in management meetings, vendor engagements, support calls, incident response activities, and after-hours escalations across multiple time zones as needed.

What you'll need

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or equivalent experience.
• 1–3 years experience in cybersecurity, IT operations, SOC operations, system administration, or related technical field.
• Understanding of cybersecurity fundamentals including phishing, malware, identity attacks, network attacks, and incident response.
• Knowledge of AI-assisted detection engineering, large language models (LLMs), agentic workflows, and security automation platforms used to improve analyst productivity and detection outcomes.
• Basic knowledge of SIEM platforms and log analysis concepts.
• Understanding of networking fundamentals including TCP/IP, DNS, HTTP, authentication, and firewalls.
• Strong analytical and problem-solving skills.
• Ability to learn quickly and work effectively within a collaborative team environment.
• Strong written and verbal communication skills.

Nice to have

• Experience with SIEM/SOAR platforms, Microsoft Defender, Azure, AWS, or similar platforms.
• Experience developing, integrating, or operationalizing AI-powered analysis, automation, and agent-based workflows within security operations, incident response, or detection engineering functions.
• Knowledge of MITRE ATT&CK framework.
• Basic scripting experience using Python, PowerShell, KQL, or SQL.
• Security+, SC-200, AZ-500, CySA+, or equivalent certifications.
• Experience participating in labs, CTFs, internships, threat hunting, or cyber research projects.

Details

• Location: Bangalore, India (Nova).
• Required travel: Yes, 10% of the time.
• Shift type: 1st Shift/Days.
• Multiple time zones and after-hours escalations as needed.
• Export licensing review may apply for non-US citizens, US permanent residents, and protected individuals for positions requiring access to technical data.