Cyber Detection Engineer

About the role

CyberOne is looking for a curious and motivated Detection Engineer focused on Microsoft Sentinel SIEM. This remote, full‑time role involves building high‑quality detections to help clients identify real threats faster across modern cloud, hybrid and enterprise environments.

Key responsibilities

• Develop, tune and maintain threat‑led detections across Microsoft Sentinel, Defender XDR and the broader Microsoft Security ecosystem using KQL and Advanced Hunting.
• Research emerging threats and translate findings into practical detections, hunting queries, workbooks, automation logic and alert enrichment.
• Validate and optimise data connectors, log sources and telemetry coverage to ensure reliable, actionable detections.
• Map detections to attacker behaviours, TTPs and frameworks such as MITRE ATT&CK and reduce false positives through structured tuning.
• Collaborate with SOC analysts, engineers and clients to improve triage, investigation workflows and documentation.

Required profile

• Hands‑on experience with Microsoft Sentinel or another SIEM platform.
• Solid understanding of cyber security fundamentals and interest in using data to identify suspicious behavioural patterns.
• Familiarity with Microsoft Defender products, Azure, Entra ID and Microsoft 365 log sources.
• Ability to document technical work clearly for both technical and non‑technical audiences.

Required skills

• KQL query writing for detection, investigation or reporting.
• Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud, Defender for Identity.
• Azure, Entra ID, Microsoft 365 and common cloud security log sources.
• Basic scripting/automation: PowerShell, Python, Logic Apps.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain or similar frameworks.