Security Detection and Automation Engineer

We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.
Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
Our role mission is to make priority threats visible and actionable by building, testing and tuning detections for attacker behaviour and control failures, and developing reliable workflows that enrich and route investigation evidence. We work closely with security operations and incident responders to turn operational feedback into better signals, usable runbooks and clearer response paths. Contribute practical engineering improvements within approved detection and automation standards, escalating missing critical telemetry, high-impact detection failures and unsafe automation rather than making unauthorised response decisions.
Responsibilities
Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.
Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.
Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.
Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.
Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.
Requirements
Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.
Will be a plus
Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.
We offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company's approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)