Detection Engineer

Job Description – Detection Engineer

Location: Dubai, UAE

Department: Information Security

Reporting To: Director, Security Engineering

Experience: 5 years preferred for this recruitment

• Overall Job Purpose

Design, develop, optimize, and maintain threat detection capabilities across the organization’s security platforms to enhance monitoring, threat visibility, and incident detection effectiveness.

• Key Accountabilities

A. Strategic Responsibilities

• Enhance enterprise detection and monitoring capabilities.
• Improve detection automation and threat visibility.
• Support continuous improvement of cyber defence operations.

B. Functional Responsibilities

• Develop and optimize SIEM, EDR/XDR, and SOAR detection use cases.
• Support threat hunting and detection engineering activities.
• Integrate threat intelligence into monitoring platforms.

C. Operational Responsibilities

• Monitor, tune, and maintain detection rules and security alerts.
• Support incident investigations and technical escalations.
• Maintain log source integrations, dashboards, and reporting.

3. Qualifications and Experience

Minimum qualification

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.

Experience

• The original job description specifies 3–6 years of experience in SOC, Detection Engineering, or Security Monitoring. For this recruitment, candidates with 5 years of relevant experience are preferred.

Language

• Fluent English.

4. Job-Specific Technical Skills

SIEM and Detection Engineering

• SIEM rule creation, tuning, and administration.
• Detection engineering and alert correlation.
• Security alert optimization and false-positive reduction.
• Log analysis, parsing, normalization, and troubleshooting.
• Security dashboards, monitoring, and reporting.

EDR/XDR and SOAR

• EDR/XDR monitoring, analytics, and investigation.
• SOAR playbook development and automation.
• Automated enrichment, alert handling, and security workflows.

Threat Hunting and Intelligence

• Threat hunting methodologies and proactive threat discovery.
• Knowledge of the MITRE ATT&CK framework.
• Threat intelligence integration into security monitoring platforms.
• Incident analysis and technical troubleshooting.

Query Languages and Scripting

• KQL (Kusto Query Language) and/or SPL (Search Processing Language).
• Python or PowerShell scripting for security automation and analysis.

OT/IoT Security

• Security monitoring for operational technology and Internet of Things environments.
• Detection and analysis of relevant security events and anomalies.

5. Technical Competencies The successful candidate should demonstrate proficiency in:

• SIEM administration and detection rule tuning.
• EDR/XDR monitoring and analysis.
• SOAR automation and playbook development.
• Log analysis and event correlation.
• Threat detection engineering and threat hunting.
• MITRE ATT&CK framework and detection coverage.
• KQL, SPL, or equivalent security query languages.
• Python or PowerShell scripting.
• Threat intelligence integration.
• Security dashboarding and reporting.
• False-positive reduction and alert optimization.

6. Behavioral Competencies

• Play to Win & Grow the Business: Contribute to stronger enterprise security and continuous improvement.
• Think Customer: Understand business requirements and operational impact when improving security monitoring.
• Team up for Top Results: Collaborate effectively with security, IT, and business teams.
• Creativity & Innovation: Develop and improve detection logic, automation, and threat visibility.
• Problem-solving and Analytical Thinking: Investigate complex security events and identify practical solutions.
• Working Under Pressure: Respond effectively in critical security environments and support incident escalations.

7. Key Responsibilities Summary The Detection Engineer will help strengthen the organization's cyber defence capabilities by building and maintaining effective detection use cases, optimizing SIEM and endpoint monitoring, automating security workflows, integrating threat intelligence, supporting threat hunting, and reducing false positives. The role also involves incident investigation support, log integration maintenance, security reporting, and continuous improvement of detection effectiveness.