Senior Detection Engineer | SecOps

Brak informacji o wynagrodzeniu

SeniorZdalnie·LondynFull-time

#471715·Dodano 5 dni temu·1

Źródło: ARQ

Aplikuj teraz

Tech Stack / Keywords

Datadog Cloud SIEMMITRE ATT&CKAWS CloudTrailTerraform Python Git SplunkAtomic Red TeamStratus Red TeamKubernetes

Podsumowanie oferty

You’ll own detection engineering for ARQ’s small global security team, building and validating threat coverage in Datadog Cloud SIEM. You’ll also build AI agents for detection workflows and support incident response for a fintech app.

Wymagania

5+ years in security, including 3+ years writing and owning detections in production.
Hands-on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic or Google SecOps.
Deep knowledge of AWS logs, particularly CloudTrail, IAM and IAM Identity Center, and experience with SaaS audit logs such as Google Workspace, GitHub, GitLab or Okta.
Experience managing detections as code using Terraform, Git, CI pipelines and code review.
Practical experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team.
Python skills for automation, log analysis and security tooling, with a record of shipping automation or AI agents that others use.
Hands-on incident response experience, from investigating alerts to documenting findings and remediation.
Ability to work independently, prioritise effectively and own outcomes in a small team without a dedicated SOC.
Strong written and verbal communication in English.

Nice to have:

Familiarity with CrowdStrike Falcon, Datadog SIEM, Cloudflare Zero Trust or WAF.
Experience working with Kubernetes (EKS) audit logs.
Threat hunting, red team or purple team experience.
Experience building agentic workflows using Claude or OpenAI.
Background in fintech, payments or crypto, with exposure to SOC 2 or PCI DSS.
Spanish or Portuguese language skills.

Obowiązki

Own detection engineering end to end in Datadog Cloud SIEM, identify missing log sources, prioritise onboarding and build reliable detection coverage.
Write, test and tune detection rules, reducing false positives while keeping meaningful threats visible.
Map coverage to MITRE ATT&CK and validate it by reproducing attacker activity.
Manage detections as code using version control, CI pipelines and code review.
Build and run automation and AI agents for rule authoring, detection validation, coverage mapping, alert triage and threat hunting.
Investigate security incidents, including triage, scoping, evidence collection and incident write-ups.
Help develop automated response and containment capabilities.
Track and communicate detection coverage, validation results and response performance to security leadership.

Benefity

Stock options.
Discretionary performance bonus.

Udziały pracownicze

Premie

ARQ

4 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz