Security Detection & Automation Engineer

We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.

Responsibilities

• Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
• Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.
• Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
• Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.
• Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
• Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
• Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.
• Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.
• Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.

Requirements

• Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
• Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
• Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
• Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
• Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
• Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
• Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
• Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
• Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
• Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
• Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.

Will be a plus

• Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
• Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

Role mission

Make priority threats visible and actionable by building, testing and tuning detections for attacker behaviour and control failures, and developing reliable workflows that enrich and route investigation evidence. Work closely with security operations and incident responders to turn operational feedback into better signals, usable runbooks and clearer response paths. Contribute practical engineering improvements within approved detection and automation standards, escalating missing critical telemetry, high-impact detection failures and unsafe automation rather than making unauthorised response decisions.

Requirements hard skills

- Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
- Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
- Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
- Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
- Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
- Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
- Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
- Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.

Requirements soft skills

- Analytical curiosity and careful testing of assumptions against evidence.
- Attention to data quality, reproducibility and clear technical documentation.
- Sound judgment about risk, approved change boundaries and when to escalate.
- Ownership of assigned work, transparent communication of blockers and reliable follow-through.
- Constructive collaboration with analysts, incident responders, other engineers and system owners.
- Willingness to learn from investigation feedback and maintain work that colleagues can review and support.

Responsibilities

- Develop, test and maintain detections for assigned priority attacker behaviours and control failures within approved detection standards.
- Validate the availability and quality of required telemetry; investigate missing fields, unreliable data or broken detection dependencies and coordinate resolution with the relevant owners.
- Tune SIEM/EDR content and false positives using evidence, while preserving required detection coverage.
- Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
- Support detection-gap analysis following incidents, threat-intelligence updates and new or changed services; recommend additional telemetry sources and response-runbook improvements.
- Collaborate with the security operations centre (SOC) and Incident Response (IR) to improve alert context, usefulness and handoffs.
- Build and maintain assigned low-risk automations for triage support, enrichment, routing, evidence collection and reporting; integrate relevant security tools, messaging and case-management workflows.
- Design workflows with appropriate approvals, access controls, logs, failure handling and rollback; validate outcomes with SOC, IR and domain owners before operational use.
- Monitor the reliability of assigned detection content and workflows; diagnose failures and unintended effects, and maintain the documentation and recovery steps needed for support and handover.
- Provide operational support for agreed detection-platform components after the relevant training and access are confirmed. Follow approved diagnostic and recovery procedures, share knowledge with the other engineer, and escalate problems beyond the assigned scope. This support follows the stated working-hours and critical-escalation arrangements.
- Approve rule logic and tuning only within approved detection standards and low-risk enrichment/routing changes only within delegated automation authority. Recommend response automations and integrations through the required approval path.
- Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager. Workflow implementation does not grant containment or incident-command authority.

Will be a plus

- Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
- Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
- Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
- Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
- Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.