Senior Detection Engineer (AI-Augumented)

Procter & Gamble is a global company producing recognized brands including Always®, Ariel®, Gillette®, Head & Shoulders®, Herbal Essences®, Oral-B®, Pampers®, Pantene®, and Tampax®. They operate in approximately 70 countries worldwide.

Required:

• 5+ years in detection engineering, security operations, or threat detection roles
• Experience writing and tuning SIEM detection rules/analytics (correlation rules, scheduled queries, real-time alerts)
• Strong understanding of MITRE ATT&CK framework and its application
• Proficiency in Python for automation, scripting, and tooling
• Experience with git-based workflows (branching, PRs, CI/CD) for managing security content
• Familiarity with security log sources including EDR, identity, cloud, network, proxy
• Strong analytical skills to distinguish true threats from noise in large datasets
• Bachelor’s degree in IT or related technical field or equal experience
• Preferred certifications: CISSP, CCSP, OSCP, GCDA, GCIA, and relevant cloud/ML/AI certifications

Preferred:

• Experience with multiple query languages
• Experience with detection-as-code practices and YAML-based formats (e.g., Sigma)
• Working knowledge of AI/LLM capabilities and security implications
• Experience with MCP servers, GitHub Copilot, or other AI-assisted workflows
• Familiarity with SOAR platforms and integration with detection pipelines
• Understanding of Kubernetes, cloud-native architectures, and OT/ICS environments

Detection Engineering (Core):

• Design, build, test, and tune detection rules mapped to MITRE ATT&CK, prioritized by threat intelligence and business risk
• Write detection logic across the SIEM and data lake platforms
• Manage detection content as code using git-based workflows, PR reviews, and CI/CD deployment pipelines
• Investigate and suppress false positives systematically
• Collaborate with Threat Hunting and Threat Intelligence teams through structured processes
• Monitor emerging threats and develop detections for new TTPs, CVEs, and active campaigns

AI-Augmented Detection (Differentiator):

• Leverage AI agents and LLM-assisted workflows to accelerate detection rule development, validation, and coverage analysis
• Use and contribute to MCP (Model Context Protocol) tooling for AI-assisted detection validation
• Operate agentic pipelines triaging rule libraries against live telemetry at scale
• Apply AI/ML techniques for anomaly detection, behavioral analytics, and pattern identification
• Stay current on frontier AI threats and translate them into detection opportunities

Collaboration & Operations:

• Work closely with SOC analysts to improve alert quality and fidelity
• Collaborate with data engineers on telemetry availability and log source onboarding
• Contribute to detection coverage reporting and MITRE ATT&CK posture measurement
• Document detection logic, tuning rationale, and suppression decisions

Employment is exclusively extended on the basis of an "Umowa o Pracę" (Full-time Employment Contract). Apply only if you agree to these conditions. Equal opportunity employer valuing diversity without discrimination. Data processing in accordance with the administrator located in Warszawa, ul. Zabraniecka 20.