About the role

Detection Engineering Consultant working hands-on to enhance cyber detection capabilities. Collaborating with security teams and translating threat intelligence into actionable detections.

Responsibilities

Designing, developing, and maintaining high-fidelity detection logic aligned to real-world threats.
Improving existing detection content to reduce alert fatigue and increase signal quality.
Ensuring detections are robust, well-tested, and supported by meaningful context and response guidance for SOC analysts and incident responders.
Translating threat intelligence, attacker TTPs, and research into actionable detection logic.
Applying threat frameworks such as MITRE ATT&CK and Cyber Kill Chain to guide detection coverage.
Conducting positive and negative testing of detection logic, including attacker emulation where appropriate.
Reviewing detection code and processes to identify gaps, weaknesses, or opportunities for improvement.
Supporting threat hunts and contributing to detection-led investigations when required.
Contributing to detection-as-code practices, CI/CD pipelines, and validation tooling.
Developing or maintaining lightweight automation and scripts to improve detection engineering workflows.
Working with platform and engineering teams to ensure detection content scales reliably across environments.
Working closely with client stakeholders to understand their environment, risks, and detection priorities.
Providing clear, practical guidance on detection strategy, coverage, and improvements.
Communicating technical findings and recommendations in a way that is accessible and actionable.
Acting as a trusted consultant while representing Bridewell values and best practices.

Developing and maintaining detection logic using query languages such as KQL or SPL.
Working with SIEM and detection platforms such as Microsoft Sentinel, Splunk, or Chronicle.
Understanding modern attacker techniques, behaviours, and evasion methods.
Translating threat intelligence into effective detection use cases.
Working knowledge of Windows, macOS, and/or Linux operating systems.
Secure, test-driven engineering practices and detection lifecycle management.
Writing or maintaining automation scripts (e.g. Python, PowerShell, Bash).
Working independently while collaborating effectively within multi-disciplinary teams.
Operating confidently in production environments at scale.
It’s a benefit if you have
Previous experience working as a Detection Engineer within an MSSP or consultancy.
Strong hands-on experience with Microsoft Sentinel detection engineering.
Knowledge of cloud infrastructure and security across Azure, AWS, or GCP.
Experience developing detections as code and integrating them into CI/CD pipelines.
Exposure to adversary emulation, purple teaming, or offensive security techniques.
Familiarity with Infrastructure as Code tools (e.g. Bicep, Terraform).