Detection Engineer

EXPERIENCE 5–8 years ENVIRONMENT Multi-client MSSP ROLE FAMILY Threat Detection & Security AnalyticsBuild Detections That MatterCyberGate is seeking an experienced Detection Engineer to build, validate, and continuously improve threat detection capabilities across managed customer environments. You will turn threat intelligence, adversary behavior, incident findings, threat-hunting results, attack simulation outcomes, and customer risk requirements into reliable and scalable security analytics.
This is a hands-on engineering role at the intersection of SOC Operations, Cyber Threat Intelligence, Threat Hunting, DFIR, security engineering, automation, and security data. You will help evolve an intelligence-led SOC through detection-as-code, automated validation, cloud and identity analytics, measurable coverage engineering, and responsible use of AI-assisted tooling.
What You Will DoDesign, develop, test, deploy, tune, and maintain detection rules, correlation logic, behavioral analytics, risk-based detections, queries, and enrichment across SIEM, XDR, EDR, NDR, UEBA, and cloud-native security the detection lifecycle from intake and prioritization through design, peer review, validation, approval, deployment, monitoring, tuning, periodic review, and retirement.
Translate adversary tactics, techniques, and procedures, threat intelligence, VAPT findings, incidents, and threat-hunting outcomes into testable detection hypotheses and production use cases.
Map detections to MITRE ATT&CK and relevant data sources; identify blind spots and develop prioritized, evidence-based coverage improvement plans.
Create positive, negative, regression, and performance tests, using representative data, controlled attack simulation, purple-team exercises, and adversary emulation where Git-based workflows and contribute to CI/CD pipelines for content review, testing, packaging, deployment, rollback, and post-deployment repetitive engineering activities using Python, PowerShell, Bash, REST APIs, platform SDKs, SOAR, or orchestration capabilities.
Define telemetry requirements and work with engineering teams to improve parsing, normalization, enrichment, retention, latency, and data quality.
Partner with SOC analysts to ensure detections include clear severity, triage context, investigation guidance, known limitations, and response auditable documentation covering requirements, test evidence, approvals, versions, tuning decisions, dependencies, and outcomes.
What You Bring5–8 years of relevant cybersecurity experience, including at least 3 years in detection engineering, SIEM content engineering, security analytics, threat hunting, SOC engineering, or a closely related discipline.
Strong hands-on experience with one or more enterprise SIEM platforms such as Microsoft Sentinel, IBM QRadar, Splunk Enterprise Security, Stellar Cyber, Elastic Security, ArcSight, or LogRhythm.
Advanced capability in relevant query or detection languages such as KQL, SPL, AQL, SQL, EQL, Lucene, YARA, or Sigma, with deep practical experience in at least one production ecosystem.
Strong understanding of MITRE ATT&CK, attacker tradecraft, threat detection, log analysis, detection limitations, rule tuning, and evidence-based with security telemetry from endpoint, network, identity, email, firewall, DNS, proxy, WAF, cloud control plane, SaaS, and vulnerability proficiency in Python and REST APIs, plus experience with Git, code review, structured testing, JSON/YAML, and CI/CD concepts.
Ability to troubleshoot complex cross-platform issues and clearly explain technical decisions to both technical and non-technical stakeholders.
Strong documentation, collaboration, prioritization, and evidence-management skills in a multi-customer environment.
Experience That Will Stand OutDetection-as-code, automated detection validation, attack simulation, purple teaming, or adversary and identity-focused detection engineering across Microsoft 365, Entra ID, Azure, AWS, or Google Cloud.
Risk-based alerting, behavioral or entity analytics, security data lakes, or graph-based detection.
AI-assisted detection engineering with strong human validation, data protection, and production-control practices.
Experience with OT/ICS detection, containers, Kubernetes, DevSecOps telemetry, or complex MSSP/MDR environments.
Exposure to regulatory or sector-specific customer requirements in the UAE or GCC.
Preferred CertificationsCertifications are valued but do not replace demonstrated engineering capability. Relevant examples include:Microsoft Certified: Security Operations Analyst Associate, Splunk security credentials, IBM QRadar certifications, or equivalent platform Certified Detection Analyst (GCDA), GIAC Certified Intrusion Analyst (GCIA), GIAC Cyber Threat Intelligence (GCTI), or comparable technical ATT&CK Defender training, purple-team credentials, or relevant cloud security Framework AlignmentThe role aligns primarily with the NICE Defensive Cybersecurity Work Role (PD-WRL-001), with supporti