SOC Engineer Detection

Shape the Future of Microsoft Sentinel Detection Engineering.

Are you passionate about Microsoft Sentinel, KQL and building high-quality detections that help a SOC identify threats effectively?

We're looking for a Senior Detection Engineer to join our growing Aerospace, Defence & Security business. You'll play a key role in designing, developing, testing and improving detection content in Microsoft Sentinel, translating threat behaviours and security requirements into reliable analytics.
This is an opportunity to join the Detection Engineering team and help strengthen detection coverage, reduce false positives and ensure detection content remains accurate, performant and operationally useful.

As a Senior Detection Engineer, you'll own detection use cases through their lifecycle, from research and data validation through KQL development, testing, deployment, tuning and continuous improvement.

Hybrid: Farnborough 3 days per week, 2 days home based.

SC Cleared or eligible.

What You'll Be Doing:

• Design, develop and maintain Microsoft Sentinel analytics rules using KQL.
• Translate threat intelligence, attacker behaviours and operational requirements into measurable detection use cases.
• Map detection content to the MITRE ATT&CK framework and help identify gaps in detection coverage.
• Validate required log sources, schemas and field mappings before developing detection logic.
• Test detections against representative data and document expected results, limitations and test evidence.
• Tune analytics to reduce false positives while preserving detection fidelity and query performance.
• Manage detection content through peer review, controlled deployment, versioning and ongoing lifecycle maintenance.
• Work with SOC analysts, threat intelligence and platform engineers to improve detections using operational feedback.
• Support threat hunting, retrospective searches and investigations using Microsoft Sentinel and KQL.
• Contribute to detection engineering standards, governance, coverage reporting and continuous improvement.

What you will bring:

• Strong hands-on experience with Microsoft Sentinel in a detection engineering or security engineering role.
• Advanced KQL skills, including building, troubleshooting and optimising queries across multiple data sources.
• Experience creating, testing, deploying and tuning scheduled analytics rules and other Sentinel detection content.
• A good understanding of detection engineering principles, false-positive reduction and the detection content lifecycle.
• Experience developing threat-informed use cases and mapping detections to MITRE ATT&CK tactics and techniques.
• Ability to assess log source suitability, data quality, parsing and field availability for detection requirements.
• Experience with Git-based version control, peer review and controlled deployment of detection content.
• Strong analytical, troubleshooting and documentation skills, with the ability to explain detection logic clearly.
• A collaborative approach to working with SOC analysts, threat intelligence, platform engineers and other security teams.

It would be great if you had:

• Experience building Microsoft Sentinel automation rules or Logic Apps playbooks for enrichment, triage or response.
• PowerShell, Python or similar scripting skills.
• Experience using Azure DevOps or another CI/CD platform to deploy and manage security content.
• Knowledge of Microsoft Defender XDR, Advanced Hunting or related Microsoft security services.
• Familiarity with infrastructure as code, ARM, Bicep or Terraform.
• Experience with detection validation, adversary simulation or purple-team exercises.
• Awareness of responsible AI-assisted engineering and practical uses of AI to support detection research, development or documentation.
• Relevant certifications such as Microsoft Security Operations Analyst Associate or other cyber security qualifications.

This role offers the opportunity to influence the future direction of detection engineering within a national security-focused SOC. You'll work alongside experienced cyber professionals, develop meaningful detections and help improve how threats are identified across complex environments.
If you're an experienced Sentinel practitioner who enjoys turning security requirements and threat behaviours into effective detection logic, we'd love to hear from you.

Employment Type: Full-time
Location: Hybrid 3 days per week in Farnborough
Security Clearance Level: Eligible for SC Clearance
Internal Recruiter: Jane
Salary: Up to £60,000
Benefits: 25 days annual leave with the option to purchase 10 extra days, Health Shields, life assurance, pension.

Loved reading about this job and want to know more about us?

?Sopra Sterias Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the clients goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UKs most complex safety- and security-critical markets.