Security Detection Engineer (x/f/m)

Description

The company is hiring a Security Detection Engineer. Hiring is run by a sister tech company, but your employment contract is with the company itself, which combines the stability of a large bank with a tech-driven working style.

The role centres on how to turn a current threat into a dependable detection. You analyse threat landscapes and attack techniques, pick out useful detection use cases, and write the matching detection logic for the security systems.

You take part in the full detection lifecycle: studying possible attack paths, building and documenting detections, testing them, and tuning existing rules over time.

Responsibilities

• Build use cases and detection rules that steadily improve attack detection across the SIEM, EDR, cloud and other security systems.
• Review current threats, attack techniques and TTPs, and turn them into detection use cases using the MITRE ATT&CK framework.
• Examine log and telemetry data to judge which sources help reveal attack techniques and suspicious behaviour.
• Test detection rules for effectiveness, and refine them to cut false positives without weakening coverage.
• Measure existing detection coverage against MITRE ATT&CK, find gaps, and propose measures to close them.
• Work with Threat Intelligence, Threat Hunting and Incident Response colleagues to turn findings from incidents and hunts into new or improved rules.
• Help the team develop Detection-as-Code processes, covering versioning, reviews, testing and automated deployment of detection content.
• Bring your ideas to improve the detection strategy, processes, measures and tooling.

Requirements

• Several years of professional IT security experience, with solid hands-on work in Detection Engineering.
• Ideally, experience in Threat Hunting or a SOC environment.
• Strong knowledge of MITRE ATT&CK and a record of turning attack techniques and TTPs into concrete detection use cases.
• Experience with SIEM, EDR or comparable detection platforms, and familiarity with their query and detection languages.
• A good grasp of security telemetry and log sources from endpoint, identity, network, cloud, Windows and Linux environments.
• A structured, analytical and solution-focused approach, with strong initiative and teamwork.
• Very good German and good written and spoken English.
• No specific university degree is needed. Vocational training or another professional background is fine if you have the relevant Detection Engineering experience.
• Not meeting every requirement is no reason to hold back. Apply anyway if your profile is close.

Conditions

The company treats fairness and diversity as a baseline and welcomes applications regardless of background, age, sex, gender identity, sexual orientation, religion or disability.