Security Detection & Automation Engineer

JustMarkets Tech

Що робити

Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
Experience with Elastic Security, Microsoft Defender or similar SIEM/EDR platforms and security workflow tools.
Practical use of Sigma, YARA or other detection-content formats, and mapping detections to MITRE ATT&CK techniques.
Experience with a scripting language, a specific SIEM query language or SOAR tooling that helps maintain the assigned integrations and workflows.
Validate telemetry availability and quality; resolve missing fields, unreliable data and broken dependencies with the relevant owners.

Translate a defined attacker behaviour or control-failure scenario into working SIEM or EDR detection logic, explaining the signal, required data, assumptions, limitations and expected analyst action.
Write and troubleshoot security-data queries; correlate relevant events and verify the fields, timestamps, source coverage and data quality needed for a detection to work.
Design repeatable tests for expected suspicious and benign activity, interpret the results, and retain evidence of what the detection does and does not cover.
Investigate noisy alerts and tune detection logic or exceptions without removing required coverage; use analyst feedback and evidence to justify changes.
Use incident findings, threat-intelligence context and attacker techniques to improve assigned detection content and identify gaps.