Detection Engineer
- Montreal, QC, Canada
Full-time
Applications open in a new tab.
Job details
- Job type
- Full-time
- Apply by
- Posting language
- English
- Posted
Original job description
Arobas Personnel is looking for an experienced Detection Engineer for a contract opportunity with one of our clients in Montreal.
The Detection Engineer will support the organization’s Splunk-based detection environment, working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections.
Key Responsibilities
🔹 Ensure operational continuity of the Splunk-based detection stack
🔹 Review and implement rule tuning requests from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustments
🔹 Design, develop, and deploy new Splunk detections based on threat patterns, indicators, and TTPs provided by the CTI team
🔹 Map new and existing detections to MITRE ATT&CK to track detection coverage
🔹 Develop and refine detection content for Purple Team exercises, incorporating identified gaps and post-exercise improvements
🔹 Test and validate detection effectiveness before production deployment, including true-positive validation and noise reduction
🔹 Maintain detection logic under version control and document tuning rationale
🔹 Track and manage work items in Jira
🔹 Participate in handoffs and collaboration sessions with Incident Response, CTI, SOC, and Red Team stakeholders
Key Deliverables
🔹 Tuned and updated Splunk detection rules addressing Incident Response requests, with documented rationale
🔹 New detection use cases covering CTI-identified threat patterns, mapped to MITRE ATT&CK
🔹 Detection content supporting Purple Team exercises, including post-exercise improvements
🔹 Up-to-date documentation of detection logic and coverage gaps
🔹 Work items properly tracked and closed in Jira
Must-Have Skills
🔹 Strong hands-on experience with Splunk, including SPL, correlation searches, dashboards, data models, and detection-as-code workflows
🔹 Proven Detection Engineering experience writing, tuning, and validating SIEM detection rules in a production environment
🔹 Working knowledge of MITRE ATT&CK for threat modeling and coverage mapping
🔹 Familiarity with relevant security telemetry and log sources, including EDR, Windows/Linux/Sysmon, network, and cloud logs
🔹 Experience with Threat Hunting methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reporting
🔹 Understanding of Incident Response processes and the ability to translate tuning requests into actionable detection rule changes
Nice To Have
🔹 Exposure to Purple Teaming and adversary emulation, including tools or approaches such as Atomic Red Team and Caldera
🔹 Scripting skills with Python and/or PowerShell for detection logic, automation, and tooling
🔹 Experience with Git for managing detection content as code
🔹 Experience with Jira in an Agile or operational environment
🔹 Ability to clearly document technical decisions and rationale for handoff to technical teams and management
Id
10059
Emplacement
Montréal
Durée De L'emploi
Temps Plein
Nombre D'emplois Vacants
1
Date Limite De Dépôt
Dernière mise à jour:
26-11-04 15:21
The Detection Engineer will support the organization’s Splunk-based detection environment, working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections.
Key Responsibilities
🔹 Ensure operational continuity of the Splunk-based detection stack
🔹 Review and implement rule tuning requests from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustments
🔹 Design, develop, and deploy new Splunk detections based on threat patterns, indicators, and TTPs provided by the CTI team
🔹 Map new and existing detections to MITRE ATT&CK to track detection coverage
🔹 Develop and refine detection content for Purple Team exercises, incorporating identified gaps and post-exercise improvements
🔹 Test and validate detection effectiveness before production deployment, including true-positive validation and noise reduction
🔹 Maintain detection logic under version control and document tuning rationale
🔹 Track and manage work items in Jira
🔹 Participate in handoffs and collaboration sessions with Incident Response, CTI, SOC, and Red Team stakeholders
Key Deliverables
🔹 Tuned and updated Splunk detection rules addressing Incident Response requests, with documented rationale
🔹 New detection use cases covering CTI-identified threat patterns, mapped to MITRE ATT&CK
🔹 Detection content supporting Purple Team exercises, including post-exercise improvements
🔹 Up-to-date documentation of detection logic and coverage gaps
🔹 Work items properly tracked and closed in Jira
Must-Have Skills
🔹 Strong hands-on experience with Splunk, including SPL, correlation searches, dashboards, data models, and detection-as-code workflows
🔹 Proven Detection Engineering experience writing, tuning, and validating SIEM detection rules in a production environment
🔹 Working knowledge of MITRE ATT&CK for threat modeling and coverage mapping
🔹 Familiarity with relevant security telemetry and log sources, including EDR, Windows/Linux/Sysmon, network, and cloud logs
🔹 Experience with Threat Hunting methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reporting
🔹 Understanding of Incident Response processes and the ability to translate tuning requests into actionable detection rule changes
Nice To Have
🔹 Exposure to Purple Teaming and adversary emulation, including tools or approaches such as Atomic Red Team and Caldera
🔹 Scripting skills with Python and/or PowerShell for detection logic, automation, and tooling
🔹 Experience with Git for managing detection content as code
🔹 Experience with Jira in an Agile or operational environment
🔹 Ability to clearly document technical decisions and rationale for handoff to technical teams and management
Id
10059
Emplacement
Montréal
Durée De L'emploi
Temps Plein
Nombre D'emplois Vacants
1
Date Limite De Dépôt
Dernière mise à jour:
26-11-04 15:21
More about this job
Responsibilities
Maintain and improve the Splunk-based detection environment by tuning existing rules, developing new detections from threat intelligence, and validating detection effectiveness before deployment. Map detection coverage to MITRE ATT&CK, support Purple Team exercises, document detection logic, and coordinate work with security teams using Jira.
Requirements
The role requires hands-on Splunk and production SIEM detection engineering experience, including writing, tuning, and validating detection rules. Candidates should understand MITRE ATT&CK, threat hunting, security telemetry, CTI, and Incident Response; Purple Teaming, scripting, Git, and Jira experience are advantageous.
Skills
- Splunk
- Search Processing Language (SPL)
- Detection Engineering
- SIEM Detection Rules
- MITRE ATT&CK
- Threat Hunting
- Cyber Threat Intelligence
- Incident Response
- Security Telemetry
- EDR
- Windows and Linux Logs
- Sysmon
- Network and Cloud Logs
- Purple Teaming
- Python
- PowerShell
Visa sponsorship
Not detected in the job text
Categories
- Technology
- Security & Safety
- Engineering
Keywords
- Splunk
- Search Processing Language (SPL)
- Correlation Searches
- Dashboards
- Data Models
- Detection As Code
- SIEM
- MITRE ATT&CK
- EDR
- Windows
- Linux
- Sysmon
- Network Logs
- Cloud Logs
- Threat Hunting
- Cyber Threat Intelligence
- Indicators Of Compromise (IOCs)
- Tactics, Techniques, And Procedures (TTPs)
- STIX/TAXII
- Incident Response
- Purple Teaming
- Adversary Emulation
- Atomic Red Team
- Caldera
- Python
- PowerShell
- Git
- Jira
- False-Positive Reduction
- Detection Validation