We are looking for a Detection Engineer with KQL or Yara-L experience. If you have detection engineering experience with other SIEM solutions and are up for a new challenge, we would like to hear from you. The successful candidate will be responsible for developing, implementing, and continuously improving Admiral’s threat led security detection analytics and response capabilities. You will need to understand the changing threat landscape, identify opportunities for improvements in existing detections, develop new detections, and ensure appropriate detection coverage for the organisation. You will work closely with multiple teams, including Security Operations, Incident Response, and Threat Intelligence, in a fast moving and agile environment.
You will be responsible for developing and driving siem and endpoint threat detections both day-to-day and strategically. You are expected to seek out effective and comprehensive detection logic thus, ensuring detections are high fidelity and thoroughly tested, and that detection rules are available and understood by operational cyber security teams.
Develop security specific content necessary to implement Use Cases that transform into correlation queries, templates, reports, rules, alerts, and dashboards.
Responsibilities
- Creation of new detections from use cases from business related projects threat modelling and threat intelligence.
- Create custom analytic rules to detect threats.
- Continuous development and testing of detection rules and tooling.
- Drive the improvement of our Detection Framework, its methodologies, and lifecycles.
- Guidance and Support for Analysts in release, implementation, and tuning phases
- Contribute to the review and lessons learned of Blue, Red and Purple Team engagements.
- Conduct knowledge-sharing sessions for edge cases from emerging threats.
- Contribution to the improvement of environmental detections (data source gap analysis)
Desirable Skills, Experience and Behaviours
- KQL Analytics or Yara- L experience is a Must.
- Configuration of Data connectors for Security Events, Threat Intelligence Platforms, Linux Syslog, Office 365, etc
- 2 years+ experience in Cyber Security as a Detection Engineer
- Knowledge of attacker tools and evasion techniques
- Working knowledge of at least one major programming language, including scripting languages like Python and PowerShell
- Good understanding of Windows and Linux Operating Systems
- Translate threat intelligence into actionable detection logic.
- Knowledge of cloud infrastructure, cloud security and cloud APIs is advantageous.
- Knowledge of Active Directory threats
- Experience working with Mitre Attack Framework
- Strong team working skills with ability to build trusted relationships with people and groups with diverse backgrounds, and to influence at all levels.
- Professional, with attention to detail - always seeking quality and excellence in their work.
- Collaborative and engaging approach to problem solving and a willingness to work as part of the team.
- Passionate for diversity, recognising the innovation and competitive edge that comes from a diverse highly skilled team where equal opportunities are truly valued.
- A problem-solver, always seeking the best solution for the right outcome.
- Friendly manner, with a willingness to adapt style and approach to achieve quality results.
- Self-motivated, results-focussed, pragmatic with the ability to manage conflicting deadlines and prioritise.
- SC-200 Certification advantageous
Our Commitment to You
At Admiral, we are committed to being a diverse and inclusive workplace. Admiral is proud to be an equal opportunities employer and does not discriminate on the basis of race, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), national origin, gender, gender identity, sexual orientation, disability, age, or any other legally protected status.
All qualified applicants will receive equal consideration for employment.
Benefits and Work-Life Balance
At Admiral, we are proud to be a diverse business where we put our people and customers first. We have great benefits to ensure employees have a great work-life balance; it's one of the reasons we’re consistently voted one of the Sunday Times Best Big Companies to Work For in the UK.
All colleagues will receive 33 days holiday (including banks holidays) when they join us, and this will increase with length of service, up to a maximum of 38 days (including banks holidays). You also have the option to buy or sell up to five days of annual leave in addition to your allocation.
You can also view some of our other key benefits here.
