Security Engineer - Detection & Response

The Security Engineer - Detection & Response is responsible for building, maintaining, and continuously improving the technical capabilities that support Cyber Detection & Response.

The role ensures strong detection coverage, reliable operational pipelines, and effective engineering support for both security monitoring and incident response.

The role focuses on implementing prioritized detection use cases end to end, including observability, telemetry pipelines, correlation, enrichment, automation, and the integrations required to operationalize them for SOC and CSIRT teams.

It also provides hands-on engineering support for response automation and orchestration, helping improve the speed, quality, and efficiency of investigative and response workflows.

Key Responsibilities:

Detection Engineering

• Design, build, and maintain high-fidelity detections across SIEM, XDR, EDR, identity, network, cloud, and data security telemetry sources.
• Correlate security telemetry with broader datasets to identify advanced threat actor tactics, techniques, and procedures (TTPs).
• Author, optimize, and maintain detection logic, including SQL-based and platform-native detection rules.
• Tune alerts continuously to reduce false positives and improve the signal-to-noise ratio for the 24/7 SOC.
• Replicate and adapt detection use cases across multiple business units, brands, and security tool tenants.

Security Automation and Orchestration

• Build, maintain, and troubleshoot Tines workflows and orchestrated playbooks to automate alert triage, enrichment, escalation, containment, and closure.
• Develop and maintain ChatOps and SecBot-driven response automations integrated with collaboration platforms such as Slack.
• Improve and support automation that enhances incident response efficiency, including enrichment workflows, notification pipelines, and dashboard reliability.
• Explore and prototype AI-assisted security workflows, such as automated malware analysis, alert correlation, and investigation support.

Telemetry Onboarding and Data Pipeline Engineering

• Engineer and maintain security data pipelines to ensure events are enriched with relevant context such as identity, asset, and geolocation data before reaching incident response teams.
• Onboard new telemetry and log sources into the detection pipeline.
• Validate log quality, perform cleanup where needed, and ensure schema alignment with detection and analytics requirements.
• Expand telemetry coverage across new brands, business units, and environments.

Incident Response Engineering Support

• Provide engineering support during security incidents, including automation of containment actions, escalation routing, and forensic data enrichment.
• Build and operate technical workflows that improve incident handling speed, consistency, and accuracy.

Platform Reliability and Operational Readiness

• Ensure the availability, effectiveness, quality, and resilience of SOC and CSIRT tooling, pipelines, and detection engineering capabilities.
• Proactively identify, troubleshoot, and urgently resolve issues affecting detections, alerting, integrations, automations, enrichments, dashboards, and Tines applications.
• Maintain the health and continuity of the SOC and CSIRT operational pipeline.

Monitoring and Process Improvement

• Continuously improve security monitoring operations, including alert filtering, notification clustering, queue handling, and escalation logic.
• Identify and implement engineering solutions that improve SOC and incident response efficiency, including automation of manual activities and system tuning.
• Improve support for after-hours, holiday, and high-volume monitoring scenarios.
• Design and implement recurring operational and stakeholder reporting.

Documentation and Continuous Improvement

• Create and maintain technical documentation, runbooks, and operational procedures related to detection engineering and security operations.
• Contribute to technology evaluations, tooling improvements, and core infrastructure modernization initiatives.
• Present innovation initiatives and technical improvements to relevant security stakeholders.

Education:

Language proficiency:

Experience:

• Minimum 3–5 years of hands-on experience in Security Engineering, Detection Engineering, SOC Engineering, or Security Operations, with a strong focus on detection development, security monitoring, and incident response.
• Advanced experience designing, implementing, and optimizing security detections, alerting strategies, and telemetry pipelines across enterprise environments, including cloud, network, endpoint, identity, and SIEM platforms.
• Advanced experience developing and maintaining security automation and orchestration workflows, including SOAR playbooks (preferably Tines) to improve incident response, alert triage, enrichment, and operational efficiency.
• Advanced experience collaborating with SOC, Incident Response, and Engineering teams to support security investigations, continuously improve detection capabilities, and implement operational best practices through documentation, reporting, and process optimization.

Mandatory Technical skills:

• Advanced experience with SIEM/XDR/EDR technologies (e.g., Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, CrowdStrike) and developing detection rules.
• Advanced experience with Tines (or similar workflow automation platforms) to build, maintain, and troubleshoot security automation workflows and orchestrated playbooks.
• Ability to understand security telemetry, log ingestion, normalization, and data pipeline engineering, including onboarding new log sources, schema mapping, and data enrichment.
• Strong knowledge of cybersecurity frameworks and incident response practices, including, threat detection methodologies, automation, and security monitoring across cloud and hybrid environments.

Soft skills:

• Highly disciplined and motivated: a self-starter who can both work independently or as a member of a team.
• Ability to demonstrate a Can-Do, delivery-focused and solution-oriented approach (rather than problem-oriented).
• Flexible, practical, and positive mindset.
• Ability to quickly adapt to changing situations.
• Ability to constantly demonstrate ownership and proactiveness in seeking to improve and optimize in anything related to their and their team's work.

Work conditions:

• Working hours: normal business hours.
• Offers on-call support during the nights, weekends and public holidays.
• Working setup: hybrid.

Diversity & Inclusion

Here at the Stefanini Group, we value plurality and equity, regardless of race, sexual orientation, disability, age, ancestry, religion, gender, and nationality. We understand and encourage the importance of being you!