Senior Staff Detection Engineer

Location: Greece Off-Site, Greece

• Determine the methods, techniques, and evaluation criteria for new detection assignments, balancing telemetry coverage, attacker behavior, alert volume, and operational cost
• Drive the insider risk and DLP detection project, extending the building block approach across multiple log sources as you help build user risk ranking
• Own committed detections through production readiness by confirming target behavior, selecting supporting telemetry, testing detection logic, documenting expected false positives, and providing response guidance for Incident Response and Insider Threat teams
• Tune existing detection content using investigator feedback, alert volume, and precision metrics to improve the quality and actionability of alerts
• Use MITRE ATT&CK and the current threat landscape to identify coverage gaps and prioritize detections that address meaningful risks
• Evaluate and apply AI assisted workflows where they can improve detection development, enrichment, or triage, validating results before operational use
• Coach detection engineers earlier in their careers on design decisions, testing discipline, tuning strategy, and production readiness

• More actionable insider risk and DLP alerts, giving Incident Response and Insider Threat investigators clearer signals to review while reducing effort spent on low value results
• A repeatable detection lifecycle built on shared methods, consistent evaluation criteria, and reusable components rather than isolated rules
• Stronger design and tuning decisions across the team as developing detection engineers apply consistent production readiness standards
• Shorter development and investigation cycles through validated AI assisted workflows for detection development, enrichment, and triage
• A detection library designed around available telemetry, real operational conditions, and the needs of the teams responding to alerts
• Clearer alignment between detection engineering and program stakeholders when available telemetry can't support a request, including agreement on what is feasible and what additional data would be required

• Bachelor's degree and a minimum of 6 years of related experience, or an advanced degree and a minimum of 5 years of related experience in detection engineering, security operations, red teaming, insider threat, or incident response, with substantial experience building detection content
• Experience building detection content in an enterprise SIEM. Elastic experience is strongly preferred
• Experience working with security telemetry from EDR, firewalls, IDS/IPS, cloud platforms, DLP, or similar enterprise sources
• Experience applying incident response, investigation, or security operations knowledge to detection design. Experience supporting insider threat or DLP programs is highly relevant, but deep detection engineering expertise is the primary requirement
• Working knowledge of MITRE ATT&CK and its application to detection design
• Proficiency in Python or another relevant programming language, with familiarity with Detection as Code, CI/CD, and security automation

• Comfortable making sound technical decisions on complex or unfamiliar problems with limited supervision, selecting an appropriate approach and evaluation criteria without requiring a detailed specification
• Precise about what a log source can support and able to align partner teams on what is feasible when available telemetry cannot meet a request
• Focused on outcomes, building detections that hold up once real alerts start firing and provide investigators with actionable signals
• Comfortable leading a deep body of work, starting with insider risk and DLP telemetry before moving to the next committed priority
• Generous with technical judgment and feedback, helping other engineers improve how they design, test, and tune detections
• Pragmatic about AI, identifying workflows where it can add value while validating results before operational use