Senior Detection Engineer (SIEM, KQL, Sigma)

title: Detection Engineer Who Writes Their Own Rules status: stable level: high falsepositives:
Analysts who only tune vendor defaults

If you’ve already spotted that this rule would never pass validation without a logsource and detection block, you’re exactly who we’re after.

A large Australian organisation is building out its security operations team under a recent SOC Manager. They want a Senior Detection Engineer to turn threat intelligence into detections that fire on the right things, and stay quiet on the wrong ones.

What you’ll be doing
Designing, building, testing and tuning detections across SIEM and EDR
Running detections as code, with version control, testing and CI/CD
Mapping coverage to MITRE ATT&CK; and closing the gaps that matter most
Cutting false positives with the managed security service provider,



so every alert that lands means something
Hypothesis-driven threat hunting, with the findings turned into recent rules
Onboarding current log sources and improving the quality of existing telemetry

What you’ll bring
Hands-on experience writing detection content in KQL, SPL or similar
Working knowledge of Sigma and ATT&CK; mapping
Experience validating detections through purple teaming or tools like Atomic Red Team
Python or PowerShell, plus Git and CI/CD habits
SOAR exposure is a bonus

The practical bits
Permanent, full time
Hybrid, Sydney
$160k to $180k base plus super
Reports to the SOC Manager

Got a detection you’re quietly proud of? I’d love to hear about it.

📌 Senior Detection Engineer Sydney (Australia)
🏢 RONIN Dynamics
📍 Australia