{"id":3056694,"url":"https://alion.io/job/philips-detection-engineer","title":"Detection Engineer","company":{"id":13838,"name":"Philips","domain":"philips.com","url":"https://alion.io/company/philips-2","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":80,"open_postings":8,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":8,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Best, Netherlands"],"countries":["NL"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":61200,"max":101900,"currency":"EUR","period":"year","gross":null,"usd_annual":114384},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"Kubernetes","optional":false},{"name":"Machine Learning","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-09-08T00:00:00Z","employer_posted_date":"2026-09-08","last_verified_at":"2026-10-23T04:38:33Z","board_verified":true,"closed_at":null,"days_open":45,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":45},"description":"Job Title\nDetection EngineerJob Description\nThe detection engineer is a member of the Cyber Defense Capabilities team and is responsible for designing, implementing, and continuously validating detection capabilities for CSIRT. This includes building high-fidelity detection logic, regression testing to ensure detections remain effective over time, and executing breach and attack simulations (BAS) to align detection coverage with evolving adversary techniques and threat intelligence.\nThe detection engineer works closely with incident responders, threat hunters, and threat intelligence analysts to drive continuous improvement and reduce mean time to detect (MTTD)\nYour role:\nDevelop, test, and maintain detection rules, signatures, and correlation logic in SIEM and related platforms.\nConduct regression testing of detection rules to ensure accuracy, resilience, and functionality following system updates or logic changes.\nPerform breach and attack simulations (BAS) to validate detection use cases, tied directly to threat intelligence and adversary TTPs.\nMap detection logic to adversary techniques using frameworks such as MITRE ATT&CK and ensure coverage of priority threat scenarios.\nIntegrate threat intelligence feeds, IOCs, and behavioral patterns into detection workflows.\nRegularly tune and refine detection logic to reduce false positives and optimize alert fidelity.\nPartner with incident response and threat hunting teams to validate detections, perform purple team exercises, and address detection gaps.\nAutomate enrichment, correlation, and triage processes through SOAR playbooks and custom scripts.\nImplement lessons learned from incidents and simulations into new or improved detections.\nMaintain documentation, detection repositories, and test playbooks for operational continuity.\nContribute to SOC metrics, including detection coverage, false positive ratios, regression test outcomes, and BAS validation reports.\nYou're the right fit if:\nBachelor’s degree in Cybersecurity, Computer Science, or related field.\nMinimum 2 years of experience in areas such as Security Architecture, Network Security, Cybersecurity Technology, Information Security or equivalent\nStrong experience with SIEM platforms (e.g., Splunk, Sentinel).\nProficiency in detection engineering, log parsing, and data normalization.\nWorking knowledge of artificial intelligence concepts and practical experience applying AI or machine learning techniques within cybersecurity functions, such as threat analysis, automation, or analytics.\nFamiliarity with adversary simulation tools (e.g., AttackIQ, Caldera, commercial BAS platforms).\nKnowledge of threat intelligence integration and frameworks (MITRE ATT&CK).\nScripting ability in Python, PowerShell, or similar languages.\nExperience with cloud environments (AWS, Azure, GCP, Aliyun) and associated security telemetry. Strong understanding of network protocols, endpoint security, and common attack techniques.\nHands-on experience with SOAR platforms and automation development.\nPrior exposure to purple team exercises and continuous validation methodologies.\nFamiliarity with detection engineering in containerized or modern application environments (Kubernetes, serverless).\nCompensation & benefits\nDoing meaningful work should come with fair, transparent rewards. The base salary range for this role is EUR 61,200 - EUR 101,900. We determine pay within the range using objective factors, like the skills the role requires, your relevant experience and the responsibility you'll have in this role, alongside internal equity and local market considerations.\nThis role is eligible for 3% short term incentive with your rewards linked to both individual performance and company results. We’ll share the full approach with you during the interview process, so you can make a clear, informed decision. Benefits include hybrid working, paid time-off, health and wellbeing benefits, learning and development opportunities.\nHow we work together\nWe believe that we are better together than apart. For our office-based teams, this means working in-person at least 3 days per week. Onsite roles require full-time presence in the company’s facilities. Field roles are most effectively done outside of the company’s main facilities, generally at the customers’ or suppliers’ locations.\nThis role is an office role.\nAbout Philips\nWe are a health technology company. We built our entire company around the belief that every human matters, and we won't stop until everybody everywhere has access to the quality healthcare that we all deserve. Do the work of your life to help the lives of others.\nLearn more about our business here.\nDiscover our rich and exciting history here.\nLearn more about our purpose here.\nIf you're interested in this role and have many, but not all, of the experiences needed, we encourage you to apply. You may still be the right candidate for this or other opportunities at Philips. Learn more about our commitment to diversity and inclusion here.\n#LI-EU","description_format":"text","description_chars":5012,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Hybrid work"],"hiring_locations":[{"name":"Netherlands","iso":"NL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Health & Medical Electronics","Respiratory & Sleep Devices","EHR & Clinical Software"],"lifecycle":[{"event":"open","at":"2026-10-22T04:04:48Z"}],"visa":[],"liveness":{"score":5,"band":"cold","label":"Long shot","p_open":1,"p_active":0.169,"p_room":0.28,"age_days":44,"expected_fill_days":8,"reasons":["conf:0","velocity","win:tail","crowd:junior,brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":114384,"is_top_pay":true},"html_url":"https://alion.io/job/philips-detection-engineer","json_url":"https://alion.io/job/philips-detection-engineer.json","meta":{"generated_at":"2026-10-23T05:38:19Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9213,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":13838},"rest":"https://alion.io/mcp/rest/get_company?id=13838"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fphilips-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fphilips-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fphilips-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/philips-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fphilips-detection-engineer"}]}