Senior Security Operational Centre Engineer

Role Overview

As a Lead Detection Engineer, you will play a key role in developing, validating, deploying and maintaining security detections across Microsoft Sentinel and Splunk SIEM platforms. The role will support the Sopra Steria Security Operations Centre by ensuring that detection content is accurate, reliable, operationally useful and aligned to the threats our clients need to monitor.

You will work with security architects, SOC teams, threat intelligence and platform engineers to turn agreed monitoring requirements and use cases into effective detection logic. This will include writing and testing KQL and SPL queries, tuning alerts, validating telemetry, supporting deployment activity and maintaining detections throughout their lifecycle.

This is a hands-on engineering role suited to someone with strong SIEM experience, good technical depth and a practical understanding of how detections are used in a live SOC environment. The successful candidate will be comfortable working across cloud, infrastructure and security telemetry sources, using automation and scripting to improve quality, consistency and efficiency.

The role requires at least 3 years experience in a similar detection engineering, SOC engineering or SIEM engineering position. The successful candidate will also need to support a hybrid working pattern, with 3 days per week working from Farnborough.

Key Responsibilities

• Develop, test, deploy and maintain detection content across Microsoft Sentinel and Splunk SIEM platforms.
• Write, tune and optimise detection logic using KQL and SPL.
• Convert approved monitoring requirements and use cases into practical, operational detections.
• Validate detections against available telemetry to confirm they work as intended and produce useful alert output.
• Tune existing detections to reduce false positives, improve fidelity and support efficient SOC investigation.
• Support the onboarding and validation of log sources required for detection coverage across cloud, infrastructure, identity, network and security tooling.
• Work with Security Architecture to understand monitoring requirements and support the definition of suitable SIEM detection approaches.
• Maintain detection documentation, including rule purpose, logic, data requirements, testing evidence, tuning history and operational context.
• Support controlled deployment of detection content in line with agreed change and release processes.
• Investigate detection issues, including missing telemetry, query performance, parsing problems and unexpected alert behaviour.
• Use automation, scripting and coding to improve detection development, validation, deployment and maintenance processes.
• Support threat-led improvement by reviewing current threats, vulnerabilities, attack techniques and operational feedback.
• Work with SOC analysts and incident responders to ensure detections are actionable, understandable and suitable for investigation.
• Support bid responses when requested, providing technical input around SIEM, detection engineering and monitoring capability.
• Engage with the Cyber Security Community of Expertise to share technical knowledge and support continuous improvement.