Security Detection & Automation Engineer

Title: Security Detection & Automation Engineer Location: Europe

We are inviting you, a highly motivated and results-oriented Detection Engineer to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.

Responsibilities

• Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
• Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.
• Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
• Support detection-gap analysis after incidents, threat-intelligence updates and service changes, and work with SOC and IR to improve telemetry, runbooks, alert context and handoffs.
• Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
• Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
• Provide operational support for agreed detection-platform components, following approved diagnostic and recovery procedures, sharing knowledge within the team and escalating issues beyond the assigned scope.
• Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.
• Escalate missing critical logs, high-impact detection failures, unsafe or failed workflows and high-impact action requests to the detection manager.

Requirements

• Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
• Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
• Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
• Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
• Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
• Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
• Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
• Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.
• Document rules, owners, dependencies, validation results and linked runbooks so another engineer or analyst can understand and maintain the work.
• Build and troubleshoot API-based integrations and low-risk security workflows for enrichment, routing, evidence collection or reporting; apply appropriate access, logging, failure handling, testing and rollback controls. No particular scripting language is required.
• Diagnose failures in assigned rules, telemetry dependencies and workflows, distinguish a local engineering issue from a missing upstream dependency, and escalate critical gaps with actionable evidence.

Will be a plus

• Detection-as-code, version control, peer review, automated rule testing or continuous-integration practices.
• Relevant security training or certifications, or experience in fintech, trading, payments or crypto environments.

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)