Detection Engineer

Arobas Personnel
is looking for an experienced
Detection Engineer
for a contract opportunity with one of our clients in
Montreal .The Detection Engineer will support the organization’s
Splunk-based detection environment, working closely with Incident Response, Cyber Threat Intelligence, SOC, and Red Team stakeholders to strengthen detection coverage and improve the quality of security detections.Key Responsibilities
Ensure operational continuity of the
Splunk-based detection stackReview and implement
rule tuning requests
from the Incident Response team, including false-positive reduction, logic refinement, and threshold adjustmentsDesign, develop, and deploy
new Splunk detections
based on threat patterns, indicators, and TTPs provided by the CTI teamMap new and existing detections to
MITRE ATT&CK
to track detection coverageDevelop and refine detection content for
Purple Team exercises, incorporating identified gaps and post-exercise improvementsTest and validate detection effectiveness before production deployment, including
true-positive validation and noise reductionMaintain detection logic under
version control
and document tuning rationaleTrack and manage work items in
JiraParticipate in handoffs and collaboration sessions with
Incident Response, CTI, SOC, and Red Team stakeholdersKey Deliverables
Tuned and updated
Splunk detection rules
addressing Incident Response requests, with documented rationaleNew detection use cases covering
CTI-identified threat patterns, mapped to MITRE ATT&CKDetection content supporting
Purple Team exercises, including post-exercise improvementsUp-to-date documentation of
detection logic and coverage gapsWork items properly tracked and closed in
JiraMust-Have Skills
Strong hands-on experience with
Splunk, including SPL, correlation searches, dashboards, data models, and detection-as-code workflowsProven
Detection Engineering
experience writing, tuning, and validating SIEM detection rules in a production environmentWorking knowledge of
MITRE ATT&CK
for threat modeling and coverage mappingFamiliarity with relevant security telemetry and log sources, including
EDR, Windows/Linux/Sysmon, network, and cloud logsExperience with
Threat Hunting
methodologies and CTI-provided IOCs/TTPs, including structured intelligence such as STIX/TAXII or narrative reportingUnderstanding of
Incident Response processes
and the ability to translate tuning requests into actionable detection rule changesNice To Have
Exposure to
Purple Teaming and adversary emulation, including tools or approaches such as Atomic Red Team and CalderaScripting skills with
Python and/or PowerShell
for detection logic, automation, and toolingExperience with
Git
for managing detection content as codeExperience with
Jira
in an Agile or operational environmentAbility to clearly document technical decisions and rationale for handoff to technical teams and managementId
10059Emplacement
MontréalDurée De L'emploi
Temps PleinNombre D'emplois Vacants
1Date Limite De Dépôt
Dernière mise à jour
26-11-04 15:21
#J-18808-Ljbffr