{"id":1225508,"url":"https://alion.io/job/wpp-security-detection-engineer-2","title":"Security Detection Engineer","company":{"id":5467,"name":"WPP","domain":"wpp.com","url":"https://alion.io/company/wpp","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":88,"open_postings":26,"ghost_share":0,"stale_share":0.5,"repost_share":0,"time_to_fill_p50_days":57,"computed_at":"2026-10-01T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chennai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17500,"max_usd":47000,"period":"year","method":"role_country_seniority_unknown","sample_n":34},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-09-25T11:01:24Z","employer_posted_date":"2026-09-25","last_verified_at":"2026-10-01T18:35:16Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"WPP is the trusted growth partner for the world’s leading brands. \nWe unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company - powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. \n\nWe work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.\n\nOur people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. \n\nFor more information, visit WPP.com.\n\nWhy we're hiring:\nDetection Engineering is responsible for designing, developing, and maintaining high-fidelity detection logic across enterprise security platforms. This role focuses on proactive threat detection, automation-first practices, and continuous improvement of detection coverage and accuracy, supporting the WPP SOC transformation into an Autonomic Security Operations model.\nWhat you'll be doing:\nDevelop, test, and maintain detection rules and logic across SIEM, EDR, NDR, and cloud-native platforms.\n Regularly review and enhance detection logic to improve accuracy, reduce noise, and align with evolving threats.\nWork with wider WPP engineering teams to ensure high-quality, normalized telemetry for effective detection.\nAutomate detection rule deployment, QA, and version control using scripting and CI/CD pipelines.\nRoot Cause Analysis (RCA)\nConduct RCA on missed detections, delayed responses, and high-severity incidents.\n Identify technical and process-level causes of detection failures or inefficiencies.\nDrive corrective actions based on RCA outcomes (e.g., rule improvements, visibility gaps).\nContinuous Security Improvement (CSI)\nMaintain a CSI backlog (detection gaps, telemetry blind spots, false positives to reduce).\n Analyze detection performance metrics to identify trends and opportunities for improvement.\nAlign detection priorities with business risk and the SOC transformation roadmap.\nCross-Team Collaboration\nCollaborate with SOC, Incident Response, and Threat Hunting teams to operationalize detection improvements.\n Work with Threat Intelligence teams to integrate emerging TTPs into detection logic.\nContribute to purple team exercises by validating detection logic against simulated attack paths.\nStrategic Alignment to GCAT SOC10x\n10X People: Continuous learning and knowledge sharing within the team.\n10X Process: Embed agile workflows and automation-first principles.\n10X Technology: Leverage AI/ML for detection tuning and anomaly detectio.\n10X Visibility: Ensure comprehensive telemetry ingestion and observability.\n10X Speed: Reduce detection-to-response cycle through orchestration and automation.\nWhat you'll need:\nTechnical Expertise\nStrong knowledge of SIEM, SOAR, EDR, and cloud security platforms.\nProficiency in scripting and automation (Python, PowerShell).\nFamiliarity with detection-as-code principles and CI/CD pipelines.\nUnderstanding of MITRE ATT&CK framework and threat-informed defense.\nCollaboration & Communication\n Ability to work closely with SOC analysts, threat hunters, and engineers.\nSkilled in documenting detection logic and RCA outcomes.\nCertifications (Preferred)\nGIAC GCTI, GCFA, or equivalent advanced security certifications.\nKey Attributes\nAutomation-first mindset with focus on scalability and resilience.\nStrong analytical and problem-solving skills.\nExcellent communication and teamwork capabilities.\nWho you are:\nYou're open: we are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.\nYou're optimistic: we approach all that we do with confidence: to try the new and to seek the unexpected.\nYou're extraordinary: We are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.\nWhat we'll give you:\nPassionate, inspired people - we champion a culture of people that do extraordinary work\nScale and opportunity - we offer the opportunity to create, influence and deliver projects at a scale that is unparalleled in the industry.\nChallenging and stimulating work - unique work and the opportunity to join a group of creative problem solvers. \n#LI-Hybrid \nWe believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.\nWPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.\nPlease read our Privacy Notice (https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment) for more information on how we process the information you provide.","description_format":"text","description_chars":5385,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Media & Entertainment","Sales & Marketing","Creative Agencies","Digital Marketing"],"lifecycle":[{"event":"open","at":"2026-09-25T13:12:16Z"}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":5,"expected_fill_days":57,"reasons":["conf:11","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-01T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/wpp-security-detection-engineer-2","json_url":"https://alion.io/job/wpp-security-detection-engineer-2.json","meta":{"generated_at":"2026-10-01T20:53:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":3287,"day_limit":5000,"remaining_today":1713,"minute_limit":60,"resets_at":"2026-10-02T00:00:00Z"}}}