Job Description

Senior Detection Engineer (SIEM, KQL, Sigma)

title: Detection Engineer Who Writes Their Own Rules
status: stable
level: high
falsepositives:
- Analysts who only tune vendor defaults

If you’ve already spotted that this rule would never pass validation without a logsource and detection block, you’re exactly who we’re after.

A large Australian organisation is building out its security operations team under a current SOC Manager. They want a Senior Detection Engineer to turn threat intelligence into detections that fire on the right things, and stay quiet on the wrong ones.

What you’ll be doing

- Designing, building, testing and tuning detections across SIEM and EDR
- Running detections as code, with version control, testing and CI/CD
- Mapping coverage to MITRE ATT&CK; and closing the gaps that matter most
- Cutting false positives with the managed security service provider,



so every alert that lands means something
- Hypothesis-driven threat hunting, with the findings turned into new rules
- Onboarding new log sources and improving the quality of existing telemetry

What you’ll bring

- Hands-on experience writing detection content in KQL, SPL or similar
- Working knowledge of Sigma and ATT&CK; mapping
- Experience validating detections through purple teaming or tools like Atomic Red Team
- Python or PowerShell, plus Git and CI/CD habits
- SOAR exposure is a bonus

The practical bits

- Permanent, full time
- Hybrid, Sydney
- $160k to $180k base plus super
- Reports to the SOC Manager

Got a detection you’re quietly proud of? I’d love to hear about it.

📌 Senior Detection Engineer (Sydney)
🏢 RONIN Dynamics
📍 Sydney