Position Title: Detection Engineer
Duration: 6+ months Contract
Client Location: Remote
Job Details:
World Wide Technology is hiring for a large financial services client. You will be the detection engineer on call during emergency vulnerability responses and incidents. When the clock is running, you build, test, and deploy new detections so the Security Operations Center can spot active exploitation while patches are still going out.
What you will do
Build, test, and deploy new detection rules quickly in monitoring tools such as Splunk and CrowdStrike
Run threat hunts during emergency vulnerability responses and incidents
Help the SOC see active exploitation while patches are being applied
Map detections to MITRE ATT&CK
What you bring
8+ years in SOC or detection engineering
Hands on experience building detections and hunts in Splunk (SPL) and CrowdStrike Falcon, including NG SIEM and LogScale queries and custom IOAs
MITRE ATT&CK mapping
Availability to be on call and move fast during emergencies
Nice to have
Sigma and YARA
Detection as code with Git and CI
Exploit analysis
SOAR
Threat intelligence consumption
Preferred certifications
GCDA, GCIA, GCED, GCTI, CrowdStrike CCFA or CCFH, Splunk certifications
Technology and frameworks
Splunk (SPL), CrowdStrike Falcon (NG SIEM and LogScale queries, custom IOAs), MITRE ATT&CK, Sigma, YARA, detection as code with Git and CI, and SOAR.