{"id":3534148,"url":"https://alion.io/job/weone-group-specialist-threat-detection","title":"Group Specialist - Threat Detection","company":{"id":4490235,"name":"We One","domain":"weone.com","url":"https://alion.io/company/weone","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"C","score":63,"open_postings":78,"ghost_share":0.615,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19500,"max_usd":42000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-07-28T13:33:05Z","employer_posted_date":"2026-07-28","last_verified_at":"2026-11-02T03:01:22Z","board_verified":true,"closed_at":null,"days_open":96,"trust":{"level":"ghost","repost_count":0,"flags":["stale","company_stale"],"days_open":96},"description":"KEY ACCOUNTABILITIES\nDevelop and operationalize AI/ML-based threat detection models across endpoint, identity, network, and cloud environments.\n\nOperationalise threat intelligence feeds into AI-driven detection pipelines, ensuring alignment with MITRE ATT&CK TTPs.\n\nDesign, develop, and deploy detection use cases across SIEM and XDR platforms.\n\nBuild, maintain, and continuously tune detection rules, KQL queries, and analytics for improved detection fidelity.\n\nDesign and enhance UEBA (User and Entity Behaviour Analytics) models to detect anomalies, insider threats, and advanced persistent threats (APTs).\n\nCollaborate with red team and adversary simulation functions to validate detection coverage against real-world attack scenarios.\n\nDrive proactive threat hunting by developing automated workflows leveraging AI-assisted query generation and anomaly detection.\n\nContinuously evaluate detection effectiveness, reduce false positives, and improve signal-to-noise ratio.\n\nIntegrate multiple threat intelligence sources and contextual data to enrich detections and improve response outcomes.\n\nContribute to the development of threat detection standards, frameworks, and best practices.\n\nMaintain up-to-date knowledge of evolving threats, adversary techniques, and detection technologies to continuously strengthen the organization’s cyber defense capabilities.\n\nAct as an ambassador for DP World at all times when working; promoting and demonstrating positive behaviours in harmony with DP World’s Principles, values and culture; ensuring the highest level of safety is applied in all activities; understanding and following DP World’s Code of Conduct and Ethics policies.\n\nPerform other related duties as assigned.\n\nQUALIFICATIONS, EXPERIENCE AND SKILLS\nKnowledge and Experience\nBachelor’s degree in computer science, Cyber Security, Information Systems, or related field.\n\n8+ years of experience in cybersecurity, with a strong focus on threat detection, threat hunting, or detection engineering.\n\nHands-on experience with SIEM/XDR platforms, preferably Microsoft Sentinel and Falcon /Cortex/Stellar Cyber/Defender XDR.\n\nStrong understanding of MITRE ATT&CK framework and adversary tactics, techniques, and procedures (TTPs).\n\nExperience in developing detection logic, analytics, and threat hunting queries (e.g., KQL).\n\nExperience in AI/ML applications for cybersecurity, including anomaly detection and behavioural analytics.\n\nExperience working with threat intelligence platforms and integrating intelligence into detection workflows.\n\nFamiliarity with cloud security (Azure, AWS), endpoint security, and identity-based threat detection.\n\nRelevant certifications such as GCIA, GCIH, GCED, AZ-500, SC-200, or equivalent are preferred.\n\nExperience in multinational environments is an advantage.\n\nSoft Skills\nStrong analytical and problem-solving skills.\nExcellent verbal and written communication skills.\nAbility to work in cross-functional teams (SOC, Red Team, Engineering).\nProactive mindset with strong attention to detail.\nAbility to manage multiple priorities in a fast-paced environment.\nContinuous learning attitude, especially in AI and emerging cyber threats.\nTechnical Skills\nProficiency in KQL (Kusto Query Language) and detection rule development.\nStrong understanding of SIEM, XDR, EDR technologies.\nExperience with UEBA and behavioural analytics platforms.\nHands-on experience of AI/ML concepts applied to cybersecurity (anomaly detection, classification models).\nUnderstanding of log sources and telemetry across endpoint, network, identity, and cloud.\nFamiliarity with scripting languages (Python, PowerShell) for automation and analysis.\nExperience with threat hunting frameworks and automation tools.\nStrong knowledge of cyber threats, attack techniques, and detection strategies.","description_format":"text","description_chars":3806,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Threat Intelligence"],"lifecycle":[{"event":"open","at":"2026-10-30T17:00:17Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.3,"p_room":0.28,"age_days":96,"expected_fill_days":29,"reasons":["conf:3","stale_co","ghost","win:tail","crowd:"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/weone-group-specialist-threat-detection","json_url":"https://alion.io/job/weone-group-specialist-threat-detection.json","meta":{"generated_at":"2026-11-02T07:43:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10952,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4490235},"rest":"https://alion.io/mcp/rest/get_company?id=4490235"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fweone-group-specialist-threat-detection"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fweone-group-specialist-threat-detection"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fweone-group-specialist-threat-detection"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/weone-group-specialist-threat-detection\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fweone-group-specialist-threat-detection"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3534148}},{"tool":"search_jobs","arguments":{"company":"weone.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3534148},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}