{"id":2597356,"url":"https://alion.io/job/cyberone-cyber-detection-engineer","title":"Cyber Detection Engineer","company":{"id":695879,"name":"CyberOne","domain":"cyberone.security","url":"https://alion.io/company/cyber-one","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"A","score":93,"open_postings":11,"ghost_share":0,"stale_share":0.091,"repost_share":0,"time_to_fill_p50_days":90,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Manila, Philippines"],"countries":["PH"],"hiring_countries":["PH"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":14000,"max_usd":42000,"period":"year","method":null,"sample_n":4941},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Copilot","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Bicep","optional":true},{"name":"CI/CD","optional":true},{"name":"Git","optional":true},{"name":"Machine Learning","optional":true},{"name":"Terraform","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-05-28T09:50:27Z","employer_posted_date":"2026-05-28","last_verified_at":"2026-10-15T16:32:41Z","board_verified":true,"closed_at":null,"days_open":140,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":140},"description":"“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant\nAbout CyberOne:\nCyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio-across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.\nJob Title:Cyber Detection Engineer\nLocation: Remote\nEmployment Type: Full-time\nThe Role:\nCyberOne helps organisations strengthen their cyber resilience through practical, expert-led security services. We work closely with clients to improve their ability to detect, investigate and respond to threats across modern cloud, hybrid and enterprise environments.\nWe are looking for a curious and motivated Detection Engineer with a focus on Microsoft Sentinel SIEM to join our growing security engineering team. This is a hands-on role for someone who enjoys solving problems, working with data, and building high-quality detections that help our solutions & clients identify real threats faster.\nWhat you’ll be doing:\nAs a Detection Engineer, you will be focused on improving detection capability, writing and tuning analytics, working with Microsoft security tooling, and helping shape how CyberOne delivers effective, threat-led monitoring for our clients utilising across Microsoft Sentinel and related Microsoft security products.\nYou will work closely with security analysts, consultants, engineers and clients to turn threat intelligence, attacker behaviours and operational lessons into actionable detection content.\nYour responsibilities will include:\nDevelop, tune and maintain threat-led detections across Microsoft Sentinel, Microsoft Defender XDR and the wider Microsoft Security ecosystem using KQL and Advanced Hunting.\n\nPerform threat intelligence-led detection engineering by researching emerging threats, vulnerabilities, attacker techniques and active campaigns, then translating relevant findings into practical detections, hunting queries and response guidance.\n\nBuilding analytics rules, hunting queries, workbooks, automation logic and alert enrichment to improve detection and response outcomes\n\nWork with log sources across Microsoft Defender, Azure, Microsoft 365, Entra ID, identity platforms, firewalls, SaaS tools and other client environments, collaborating with SecOps Engineers to recommend table schema, parsing, normalisation and ingestion optimisation improvements that enhance detection quality and operational efficiency.\n\nValidate and optimise data connectors, log sources, telemetry coverage and Microsoft Content Hub detection capability to ensure detections are reliable, actionable and suitable for CyberOne client environments.\n\nMapping detections to attacker behaviours, TTPs and frameworks such as MITRE ATT&CK.\n\nReduce false positives through structured tuning, baselining, alert performance review and feedback from SOC analysts and incident responders.\n\nHelping develop reusable detection content, playbooks and best-practice templates for CyberOne clients.\n\nCollaborating with SOC analysts and incident responders to improve triage quality and investigation workflows.\n\nProducing clear documentation for detections, use cases, data requirements, assumptions and response guidance.\n\nSupport client workshops and technical discussions around detection coverage, Sentinel maturity, Defender XDR adoption, unified SecOps and monitoring / detection strategy.\n\nKeep up to date with emerging threats, Microsoft security capabilities, Defender XDR enhancements and detection engineering techniques.\n\nEmployees are expected to demonstrate a security-first mindset and ensure that information security considerations are incorporated into their day-to-day activities, decision-making, and interactions with customers, suppliers, and colleagues.\n\nYou will work with the freedom to suggest improvements, champion developments, and enhance how CyberOne identifies threat for all our clients.\nWhat we’re looking for:\nWe are open to candidates from different backgrounds. You may already be working in detection engineering, SOC engineering, security operations, cloud security, incident response or Microsoft security consulting. You might also be an analyst who enjoys KQL, automation and improving how detections work. You should have a solid understanding of cyber security fundamentals as well as a strong interest and understanding in using data to identify suspicious behavioural patterns.\nIdeally, you will be able to demonstrate experience with some of the following:\nHands-on experience with Microsoft Sentinel or another SIEM platform.\n\nExperience writing KQL queries for detection, investigation or reporting.\n\nUnderstanding of Microsoft Defender products, such as Defender for Endpoint, Defender for Office 365, Defender for Cloud or Defender for Identity.\n\nFamiliarity with Azure, Entra ID, Microsoft 365 and common cloud security log sources.\n\nKnowledge of security monitoring concepts, alert logic, false positive tuning and detection lifecycle management.\n\nInterest in attacker behaviours, persistence techniques, lateral movement, credential abuse and common cloud attack paths.\n\nAwareness of frameworks such as MITRE ATT&CK, Cyber Kill Chain or similar.\n\nAbility to document technical work clearly and explain detection logic to both technical and non-technical audiences.\n\nBasic scripting or automation skills, for example PowerShell, Python, Logic Apps or similar.\n\nA collaborative mindset and willingness to work with analysts, engineers, consultants and clients.\n\nNice to have:\nThe following would be useful, but they are not essential:\nMicrosoft certifications such as SC-200, AZ-500, SC-100 or SC-900.\n\nExperience with Sentinel as code, CI/CD pipelines, ARM, Bicep, Terraform or Git-based content management.\n\nExperience building Sentinel workbooks, playbooks or automation rules.\n\nExposure to SOAR processes and incident response automation.\n\nExperience with threat hunting or purple-team-style detection validation.\n\nFamiliarity with Sigma, YARA, structured detection content or detection-as-code approaches.\n\nExperience working in an MSSP, consultancy or client-facing security environment.\n\nKnowledge of statistics, data science, AI or machine learning as applied to cyber security.\n\nThe kind of person who will succeed:\nYou will do well in this role if you are naturally curious, comfortable working through messy data, and motivated by improving how security teams detect real threats. You should enjoy asking “what would an attacker do?” and turning that thinking into reliable, practical detection content.\nWe value people who are proactive, thoughtful and willing to learn. You do not need to know everything on day one, but you should be comfortable researching unfamiliar technologies, testing ideas and improving your work based on feedback.\nWhy Join Us?\nWork with cutting-edgeAzure technologiesand drive cloud transformation projects.\n\nBe part of a dynamic team that valuesinnovation, collaboration, and technical excellence.\n\nCompetitive compensation, career growth opportunities, and access tocontinuous learningand certifications.\n\nOpportunity to work on impactful cloud initiatives across various industries.\n\nWhy CyberOne:\nElite positioning: Microsoft Security Partner, CREST & NCSC-certified\n\nAccess to cutting-edge MXDR platform & proprietary SecOps tools\n\nNo glass ceilings: rapid growth, fast-track leadership opportunities\n\nCulture-first: bold values, open feedback, and relentless innovation\n\nWhat’s In It for You:\nFlexible working hours & remote-first culture\n\nBirthday off, long-service awards\n\nBi-annual performance awards and team off-sites\n\nStructured training, technical exposure, and career pathing\n\nLet’s redefine what it means to be secure. Together.","description_format":"text","description_chars":8091,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Flexible schedule","Growth opportunities"],"hiring_locations":[{"name":"Philippines","iso":"PH","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-15T07:31:38Z"}],"visa":[],"liveness":{"score":22,"band":"cold","label":"Long shot","p_open":1,"p_active":0.616,"p_room":0.36,"age_days":140,"expected_fill_days":90,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-15T18:04:51Z"},"pay":null,"html_url":"https://alion.io/job/cyberone-cyber-detection-engineer","json_url":"https://alion.io/job/cyberone-cyber-detection-engineer.json","meta":{"generated_at":"2026-10-15T18:04:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27406,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":695879},"rest":"https://alion.io/mcp/rest/get_company?id=695879"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcyberone-cyber-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcyberone-cyber-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcyberone-cyber-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cyberone-cyber-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcyberone-cyber-detection-engineer"}]}