{"id":3681687,"url":"https://alion.io/job/justmarkets-security-detection-automation-engineer","title":"Security Detection & Automation Engineer","company":{"id":678193,"name":"JustMarkets","domain":"justmarkets.com","url":"https://alion.io/company/justmarkets","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":76,"open_postings":108,"ghost_share":0.324,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":70,"computed_at":"2026-11-08T05:47:12Z"}},"role":"DevOps","role_family":"DevOps","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_regions","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["DE","FR","GB","AT","BE","BG","HR","CZ","DK","FI","HU","IE","IT","NL","NO","PL","RO","ES","SE","CH","EE","GR","IS","LV","LI","LT","LU","MT","PT","SK","SI"],"hiring_countries_total":31,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"SIEM","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false}],"status":"live","first_seen_at":"2026-11-03T08:58:04Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-08T20:20:00Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":4},"description":"We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.\nOur team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.\nResponsibilities\nDevelop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.\nValidate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.\nDocument detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.\nSupport detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.\nBuild low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.\nMonitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.\nProvide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.\nApprove rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.\nEscalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.\nRequirements\nTranslate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.\nExperience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.\nPractical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.\nExperience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.\nWrite and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.\nDesign repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.\nInvestigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.\nUse incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.\nDocument rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.\nBuild and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.\nDiagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.\nWill be a plus\nDetection-as-code, version control, peer review, automated rule testing or continuous-integration practices.\nRelevant security training or certifications, or experience in fintech, trading, payments or crypto environments.\nWe offer\n20 paid vacation days per year\n10 paid sick leave days per year\nPublic holidays as per the company's approved Public holiday list\nMedical budget\nOpportunity to work remotely\nProfessional education budget\nLanguage learning budget\nWellness budget (gym membership, sports gear and related expenses)","description_format":"text","description_chars":4407,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Gym membership"],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"region"},{"name":"France","iso":"FR","kind":"region"},{"name":"United Kingdom","iso":"GB","kind":"region"},{"name":"Austria","iso":"AT","kind":"region"},{"name":"Belgium","iso":"BE","kind":"region"},{"name":"Bulgaria","iso":"BG","kind":"region"},{"name":"Croatia","iso":"HR","kind":"region"},{"name":"Czech Republic","iso":"CZ","kind":"region"},{"name":"Denmark","iso":"DK","kind":"region"},{"name":"Finland","iso":"FI","kind":"region"},{"name":"Hungary","iso":"HU","kind":"region"},{"name":"Ireland","iso":"IE","kind":"region"},{"name":"Italy","iso":"IT","kind":"region"},{"name":"Netherlands","iso":"NL","kind":"region"},{"name":"Norway","iso":"NO","kind":"region"},{"name":"Poland","iso":"PL","kind":"region"},{"name":"Romania","iso":"RO","kind":"region"},{"name":"Spain","iso":"ES","kind":"region"},{"name":"Sweden","iso":"SE","kind":"region"},{"name":"Switzerland","iso":"CH","kind":"region"},{"name":"Estonia","iso":"EE","kind":"region"},{"name":"Greece","iso":"GR","kind":"region"},{"name":"Iceland","iso":"IS","kind":"region"},{"name":"Latvia","iso":"LV","kind":"region"},{"name":"Liechtenstein","iso":"LI","kind":"region"},{"name":"Lithuania","iso":"LT","kind":"region"},{"name":"Luxembourg","iso":"LU","kind":"region"},{"name":"Malta","iso":"MT","kind":"region"},{"name":"Portugal","iso":"PT","kind":"region"},{"name":"Slovakia","iso":"SK","kind":"region"},{"name":"Slovenia","iso":"SI","kind":"region"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Forex & CFD Brokers"],"lifecycle":[{"event":"open","at":"2026-11-03T13:22:33Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":70,"reasons":["conf:1","velocity","win:early","comp:brand"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/justmarkets-security-detection-automation-engineer","json_url":"https://alion.io/job/justmarkets-security-detection-automation-engineer.json","meta":{"generated_at":"2026-11-08T23:47:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":49455,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678193},"rest":"https://alion.io/mcp/rest/get_company?id=678193"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjustmarkets-security-detection-automation-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjustmarkets-security-detection-automation-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjustmarkets-security-detection-automation-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/justmarkets-security-detection-automation-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjustmarkets-security-detection-automation-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3681687}},{"tool":"search_jobs","arguments":{"company":"justmarkets.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3681687},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}