Lead Detection Engineer
On-siteTel Aviv, Tel Aviv, Israel
Job Summary
Set the direction for detection engineering by defining standards, tooling, and coverage strategy across endpoint, identity, cloud, and infrastructure. Build high-fidelity behavioral detections in SIEM and EDR platforms using Detection-as-Code pipelines with version control, testing, and CI/CD. Connect detections to enrichment, triage, and automated response workflows while validating logic through threat simulations and continuous testing. Partner with SOC analysts to close feedback loops and translate threat intelligence into scalable, evasion-resistant detections. Make architectural decisions that scale as the team grows and communicate coverage posture to security leadership.
Required Qualifications
- Minimum 3 years in detection engineering, security operations, or a hybrid offensive/defensive role
- Experience owning or leading detection engineering work as a senior technical contributor
- Strong understanding of attacker tradecraft and adversary behavior
- Hands-on experience with at least one enterprise SIEM and EDR platform — Splunk, Microsoft Sentinel, CrowdStrike, or equivalent
- Strong query development skills in SPL, KQL, Sigma, or similar
- Solid engineering practices: Git, CI/CD, code review, Detection-as-Code workflows
- Experience using MITRE ATT&CK to design, validate, and measure detection coverage
- Ability to make and defend technical decisions and establish standards others adopt
- Applicants must be authorized to work in the country in which they apply
Desired Qualifications
- Offensive security background or certifications
- Experience with threat hunting and detection validation frameworks
- Experience designing SOAR playbooks and automated response workflows
- Cloud security depth across Azure, AWS, or GCP
- Experience building AI-assisted detection, investigation, or triage workflows
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.