Cyber Detection Engineer

I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC. - CyberOne Consultant

About CyberOne

CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio-across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.

Job Title

Cyber Detection Engineer

Location

Remote

Employment Type

Full-time

The Role

CyberOne helps organisations strengthen their cyber resilience through practical, expert-led security services. We work closely with clients to improve their ability to detect, investigate and respond to threats across modern cloud, hybrid and enterprise environments. We are looking for a curious and motivated Detection Engineer with a focus on Microsoft Sentinel SIEM to join our growing security engineering team. This is a hands-on role for someone who enjoys solving problems, working with data, and building high-quality detections that help our solutions & clients identify real threats faster.

What you’ll be doing

As a Detection Engineer, you will be focused on improving detection capability, writing and tuning analytics, working with Microsoft security tooling, and helping shape how CyberOne delivers effective, threat-led monitoring for our clients utilising across Microsoft Sentinel and related Microsoft security products.

You will work closely with security analysts, consultants, engineers and clients to turn threat intelligence, attacker behaviours and operational lessons into actionable detection content.

Your responsibilities will include:

• Develop, tune and maintain threat-led detections across Microsoft Sentinel, Microsoft Defender XDR and the wider Microsoft Security ecosystem using KQL and Advanced Hunting.
• Perform threat intelligence-led detection engineering by researching emerging threats, vulnerabilities, attacker techniques and active campaigns, then translating relevant findings into practical detections, hunting queries and response guidance.
• Building analytics rules, hunting queries, workbooks, automation logic and alert enrichment to improve detection and response outcomes
• Work with log sources across Microsoft Defender, Azure, Microsoft 365, Entra ID, identity platforms, firewalls, SaaS tools and other client environments, collaborating with SecOps Engineers to recommend table schema, parsing, normalisation and ingestion optimisation improvements that enhance detection quality and operational efficiency.
• Validate and optimise data connectors, log sources, telemetry coverage and Microsoft Content Hub detection capability to ensure detections are reliable, actionable and suitable for CyberOne client environments.
• Mapping detections to attacker behaviours, TTPs and frameworks such as MITRE ATT&CK.
• Reduce false positives through structured tuning, baselining, alert performance review and feedback from SOC analysts and incident responders.
• Helping develop reusable detection content, playbooks and best-practice templates for CyberOne clients.
• Collaborating with SOC analysts and incident responders to improve triage quality and investigation workflows.
• Producing clear documentation for detections, use cases, data requirements, assumptions and response guidance.
• Support client workshops and technical discussions around detection coverage, Sentinel maturity, Defender XDR adoption, unified SecOps and monitoring / detection strategy.
• Keep up to date with emerging threats, Microsoft security capabilities, Defender XDR enhancements and detection engineering techniques.
• Employees are expected to demonstrate a security-first mindset and ensure that information security considerations are incorporated into their day-to-day activities, decision-making, and interactions with customers, suppliers, and colleagues.

You will work with the freedom to suggest improvements, champion developments, and enhance how CyberOne identifies threat for all our clients.

What we’re looking for

We are open to candidates from different backgrounds. You may already be working in detection engineering, SOC engineering, security operations, cloud security, incident response or Microsoft security consulting. You might also be an analyst who enjoys KQL, automation and improving how detections work. You should have a solid understanding of cyber security fundamentals as well as a strong interest and understanding in using data to identify sus