{"id":684312,"url":"https://alion.io/job/justmarkets-detection-engineering-automation-lead","title":"Detection Engineering & Automation Lead","company":{"id":678193,"name":"JustMarkets","domain":"justmarkets.com","url":"https://alion.io/company/justmarkets","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":77,"open_postings":98,"ghost_share":0.306,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":83,"computed_at":"2026-10-20T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_regions","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["DE","FR","GB","AT","BE","BG","HR","CZ","DK","FI","HU","IE","IT","NL","NO","PL","RO","ES","SE","CH","EE","GR","IS","LV","LI","LT","LU","MT","PT","SK","SI"],"hiring_countries_total":31,"salary":null,"salary_estimate":{"min_usd":95000,"max_usd":248000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":679},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"LLM","optional":false},{"name":"Maltego","optional":false},{"name":"MISP","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false}],"status":"live","first_seen_at":"2026-08-04T16:06:52Z","employer_posted_date":"2026-08-04","last_verified_at":"2026-10-20T12:13:13Z","board_verified":true,"closed_at":null,"days_open":76,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":76},"description":"We are looking for a Detection Engineering & Automation Lead to improve detection quality and automation so high-risk attacker behavior is identified with less noise and faster investigation.\nThis is a unique opportunity to help build and mature the Detection Engineering & Automation function from an early stage, shaping processes, detection strategy, automation, and engineering best practices.\nResponsibilities\nLead and develop the Detection Engineering & Automation squad, setting priorities, mentoring team members, and driving the delivery of detection and automation initiatives\nOwn the detection lifecycle end-to-end, including use-case definition, development, testing, tuning, and retirement\nBuild and maintain SIEM/EDR detection rules, detection-as-code, enrichment workflows, and SOAR automation playbooks\nCollaborate with SOC, Cyber Defense leadership, Incident Response, and engineering teams to review false positives, reduce alert noise, and address detection coverage gaps\nMap detections to critical assets, attacker TTPs, telemetry sources, and incident response runbooks\nEnsure critical detections have a clear owner, documentation, and validated testing evidence\nLead security automation initiatives that accelerate investigations while avoiding unsafe autonomous actions\nRequirements\nHigher education in Computer Science, Information Security, or a related technical field is preferred\n5+ years of experience in SOC, Detection Engineering, Threat Detection, or Security Automation\n2+ years of hands-on experience in Detection Engineering\n1+ year of experience leading or mentoring a team of engineers\nHands-on experience writing and tuning detection content (Sigma, YARA, SIEM correlation rules) and applying detection-as-code practices\nExperience with SOAR platforms, automation playbooks, and scripting (Python or similar) to build integrations and automate security workflows\nStrong understanding of attacker TTPs (MITRE ATT&CK), telemetry sources (EDR, network, cloud, identity), and incident response workflows\nExperience defining and tracking Detection Engineering metrics and KPIs (MTTD, MTTR, false-positive rate, and detection coverage)\nEnglish - Intermediate+\nUkrainianRussian - Upper-intermediate \nWill be a plus\nExperience in fintech, brokerage, trading platforms, payments, or other regulated financial environments\nExperience with cloud-native detection (CNAPP/CSPM) across AWS, GCP, and Azure\nExperience with AI/LLM-assisted alert summarization or detection tooling\nThreat intelligence and threat hunting experience (CTI feeds, MISP, Maltego, or similar tools)\nPrevious experience building a Detection Engineering function from an early maturity stage\nWe offer\n20 paid vacation days per year\n10 paid sick leave days per year\nPublic holidays as per the company’s approved Public holiday list\nMedical budget\nOpportunity to work remotely\nProfessional education budget\nLanguage learning budget\nWellness budget (gym membership, sports gear and related expenses)","description_format":"text","description_chars":2993,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Intermediate (B1)","optional":false}]},"benefits":["Gym membership"],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"region"},{"name":"France","iso":"FR","kind":"region"},{"name":"United Kingdom","iso":"GB","kind":"region"},{"name":"Austria","iso":"AT","kind":"region"},{"name":"Belgium","iso":"BE","kind":"region"},{"name":"Bulgaria","iso":"BG","kind":"region"},{"name":"Croatia","iso":"HR","kind":"region"},{"name":"Czech Republic","iso":"CZ","kind":"region"},{"name":"Denmark","iso":"DK","kind":"region"},{"name":"Finland","iso":"FI","kind":"region"},{"name":"Hungary","iso":"HU","kind":"region"},{"name":"Ireland","iso":"IE","kind":"region"},{"name":"Italy","iso":"IT","kind":"region"},{"name":"Netherlands","iso":"NL","kind":"region"},{"name":"Norway","iso":"NO","kind":"region"},{"name":"Poland","iso":"PL","kind":"region"},{"name":"Romania","iso":"RO","kind":"region"},{"name":"Spain","iso":"ES","kind":"region"},{"name":"Sweden","iso":"SE","kind":"region"},{"name":"Switzerland","iso":"CH","kind":"region"},{"name":"Estonia","iso":"EE","kind":"region"},{"name":"Greece","iso":"GR","kind":"region"},{"name":"Iceland","iso":"IS","kind":"region"},{"name":"Latvia","iso":"LV","kind":"region"},{"name":"Liechtenstein","iso":"LI","kind":"region"},{"name":"Lithuania","iso":"LT","kind":"region"},{"name":"Luxembourg","iso":"LU","kind":"region"},{"name":"Malta","iso":"MT","kind":"region"},{"name":"Portugal","iso":"PT","kind":"region"},{"name":"Slovakia","iso":"SK","kind":"region"},{"name":"Slovenia","iso":"SI","kind":"region"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Forex & CFD Brokers"],"lifecycle":[{"event":"open","at":"2026-09-10T23:59:16Z"}],"visa":[],"liveness":{"score":54,"band":"ok","label":"Likely open","p_open":1,"p_active":0.903,"p_room":0.6,"age_days":76,"expected_fill_days":83,"reasons":["conf:2","velocity","win:late","crowd:"],"computed_at":"2026-10-20T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/justmarkets-detection-engineering-automation-lead","json_url":"https://alion.io/job/justmarkets-detection-engineering-automation-lead.json","meta":{"generated_at":"2026-10-20T12:55:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14291,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678193},"rest":"https://alion.io/mcp/rest/get_company?id=678193"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjustmarkets-detection-engineering-automation-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjustmarkets-detection-engineering-automation-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjustmarkets-detection-engineering-automation-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/justmarkets-detection-engineering-automation-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjustmarkets-detection-engineering-automation-lead"}]}