Detection Engineer

Detection Engineer in London | Sanderson Government and Defence Find a job Post a job Sign up Tired of searching? Let’s find you the right jobs faster Get Started Search These jobs were popular with other job seekers SOC Detection Engineer Gazelle Global Consulting Ltd West Midlands Negotiable 3 days ago Security Engineer, DevSecOps, AWS, EKS Sanderson Recruitment London £600 - £650 per day 2 days ago Security Engineering Consultant Sanderson Recruitment London £550 - £650 per day 1 week ago Security Engineer Anson Mccade South West London (SW1) Up to £575 per day 3 days ago Senior Security Engineer - Isovalent Cisco London 1 day ago Detection Engineer Sanderson Government and Defence London Outside IR35 3 days ago Security Engineer - Microsoft E5 Sanderson Recruitment Milton Keynes (MK1) £475 - £525 per day 4 days ago Security Engineer Sanderson Government and Defence London £400 - £450 per annum + Outside IR35 3 days ago Senior DevSecOps Engineer Sanderson Recruitment London £600 - £650 per day 4 weeks ago Senior Cyber Security Engineer Morson Edge Cambridgeshire Market related 1 week ago Detection Engineer Sanderson Government and Defence London; City of London; East London; Central London; South East London; West London; Canary Wharf; South West London; North London; Greenwich; Stratford Temporary Contract; On-site Published: 2 days ago Negotiable Apply Save Detection Engineer Sanderson Government and Defence Apply Detection Engineer (SOC / SIEM / Splunk) £450 per day | Outside IR35 | 9-Month Contract Active SC Clearance Required London (1 day per month onsite) A leading consultancy is looking for a Detection Engineer to join a high-profile cyber security programme supporting critical public sector services. This role offers a unique blend of detection engineering and SOC operations , providing the opportunity to develop and optimise advanced detection capabilities while helping protect large-scale cloud environments. Working within a Security Operations Centre (SOC), you'll be responsible for building and tuning detections, investigating security incidents, and improving the effectiveness of security monitoring across AWS and Splunk environments. The Role As a Detection Engineer, you will operate at the intersection of security operations, threat detection, and cloud security. You'll work closely with SOC analysts, engineers, and stakeholders to develop high-fidelity detections, reduce false positives, and strengthen overall security visibility. This is an excellent opportunity for someone with Splunk and AWS security monitoring experience who enjoys both hands-on threat analysis and detection development. Key Responsibilities Detection Engineering Develop, test, and optimise Splunk SPL correlation searches and alerting logic. Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures (TTPs). Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs. Tune and enhance detection content to improve alert accuracy and reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process activity, and suspicious network traffic. Support incident response activities through containment and escalation procedures. Maintain detailed security case documentation and investigation notes. Contribute towards operational metrics including MTTD and MTTR targets. Essential Skills & Experience Active SC Clearance (required). 1-3 years' experience within a SOC Analyst, Security Analyst, Detection Engineer, or Security Operations role. Strong hands-on experience with Splunk and SPL query development. Experience building, tuning, and maintaining SIEM detection rules. AWS security monitoring experience including: CloudTrail GuardDuty IAM VPC Flow Logs Understanding of cyber attack techniques and threat detection methodologies. Knowledge of incident triage, investigation, and escalation processes. Experience working with Windows, Linux, authentication systems, and endpoint security logs. Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation platforms. Scripting experience in Python, PowerShell, or Bash. Experience working within UK Government or public sector environments. Azure and/or Google Cloud Platform exposure. Reasonable Adjustments: Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients. If you need any help or adjustments during the recruitment process for any reason , please let us know when you apply or talk to the recruiters directly so we can support you. Apply Sanderson Government and Defence HR Services, Recruitment & Selection 138 Jobs Similar Detection Engineer Jobs Popular with Other Job Seekers SOC Detection Engineer Gazelle Global Consulting Ltd West Midlands Negotiable 3 days ago Security Engineer, DevSecOps, AWS, EKS Sanderson Recruitment London £600 - £650 per day 2 days ago Security Engineering Consultant Sanderson Recruitment London £550 - £650 per day 1 week ago Security Engineer Anson Mccade South West London (SW1) Up to £575 per day 3 days ago Senior Security Engineer - Isovalent Cisco London 1 day ago Detection Engineer Sanderson Government and Defence London Outside IR35 3 days ago Security Engineer - Microsoft E5 Sanderson Recruitment Milton Keynes (MK1) £475 - £525 per day 4 days ago Security Engineer Sanderson Government and Defence London £400 - £450 per annum + Outside IR35 3 days ago Senior DevSecOps Engineer Sanderson Recruitment London £600 - £650 per day 4 weeks ago Senior Cyber Security Engineer Morson Edge Cambridgeshire Market related 1 week ago Detection Engineer jobs Engineering jobs Full Time jobs Weekend jobs Retail jobs Amazon Warehouse Operative jobs Christmas jobs Night Shift jobs NHS jobs Apprenticeship jobs Warehouse jobs Cleaning jobs No Experience jobs Remote jobs Admin jobs Administration jobs Apprenticeships jobs Tesco jobs Get hired. Find success. Get started Totaljobs About us Careers at Totaljobs Press Partners Privacy policy Terms and conditions Cookies Legal and compliance Accessibility Jobseekers Salary Planner Jobseeker help centre Career advice Recruiters Post job ads Recruiting news Courses Contact us - recruiters Recruit internationally Download App store Play store The Stepstone Group UK Ltd © 2026 We use cookies We use cookies to operate our website, measure how people use our services to help us improve them, enrich usage profiles and personalise the content displayed to you. We also share information about your use of our site with our social media, advertising, and analytics partners, who may combine it with other information, to show you relevant ads on other websites, and to measure the performance of our advertising. Some cookies are essential for the operation of our website. If you would prefer us not to use the non-essential cookies, click “Just necessary”, but please be aware that this may impact your experience of our site and the services we are able to offer. Click “Accept” if you’re happy for us to place these cookies. You can change your mind at any time. Store and / or access information on a device Cookies, device identifiers, or other information can be stored or accessed on your device for the purposes presented to you. Personalised ads and content, ad and content measurement, audience insights and product development Ads and content can be personalised based on a profile. More data can be added to better personalise ads and content. The performance of ads and content can be measured. Insights about audiences who have viewed the ads and content can be extracted. Data can be used to build or improve user experience, systems and software. Display third-party content (social networks, videos) Content from social networks and embedded content from third-party providers can be displayed. Identifiers derived from authentications If an identifier is created based on authentication data, such as contact details associated with online accounts you have set up on websites or apps (e.g. email address, phone number) or customer identifiers (e.g. an identifier provided by your telecommunications provider), then this identifier can be used to recognize you across websites, apps and devices if you are logged in with the same contact details. Just Necessary Accept All Cookie Settings You can also exercise your right to object to data processing based on legitimate interests under “Privacy Policy”. Privacy Policy Cookie policy