Lead Cloud Detection & Threat Modelling Engineer

Lead Cloud Detection & Threat Modelling Engineer in City of London (EC1) | Smart Sourcer Limited Find a job Post a job Sign up Never miss an opportunity. We’ll find jobs that fit Get Started Search These jobs were popular with other job seekers SIEM Engineering Specialist Randstad Digital Birmingham (B1), B1 £550 - £560 per annum 23 hours ago NEW Senior Oracle Cloud Technical Consultant Hackajob Ltd St James, South West London (SW1) Competitive 1 day ago Senior Cloud & AI Security Enablement Engineer Hackajob Ltd Clerkenwell, City of London (EC1) Competitive 1 day ago Solutions Architect - Oracle HCM Sanderson Recruitment Bristol (BS1) £800 - £850 per day 21 hours ago NEW Detection Engineer Sanderson Government and Defence London Negotiable 1 week ago Security Platform Engineer, UK Security Operations Hackajob Ltd St James, South West London (SW1) Competitive 1 day ago Integration Architect Hackajob Ltd St James, South West London (SW1) Competitive 1 day ago Senior Platform Engineer Anson Mccade Manchester (M11) From £55,000 to £65,000 per annum 1 day ago Systems Integration Engineer Hackajob Ltd Warton, Carnforth (LA5) Up to £49k per year 1 day ago Senior Solution Architect – Microsoft Dynamics 365 Bilge Adam Technologies UK Ltd London From £70,000 to £90,000 per annum 2 weeks ago Lead Cloud Detection & Threat Modelling Engineer Smart Sourcer Limited City of London (EC1) Temporary Contract; On-site Published: 23 hours ago From £110,000 to £120,000 per annum Apply Save Lead Cloud Detection & Threat Modelling Engineer Smart Sourcer Limited Apply Lead Cloud Detection & Threat Modelling Engineer – AWS, Azure, Sentinel, Elastic Stack, SOAR platforms ? 6 Month Fixed-Term Contract ? £110k-£120k pro rata ? 100% remote Build Detection Engineering, Threat Modelling & Security Automation Across Azure and AWS We're looking for a hands-on Senior Cloud Detection Engineer to help mature and scale our cloud security monitoring, detection and response capabilities across a complex, global, multi-cloud environment. This role is ideal for someone who has progressed from a Senior SOC Analyst background into Threat Modelling & Detection Engineering and is passionate about threat detection, attack path analysis, automation, and incident response engineering. Working closely with the CISO, Security Engineering team and SOC partners, you'll own the end-to-end lifecycle of threat detection, from threat modelling and attack simulation through to detection development, automated response orchestration, tuning and continuous improvement. What You'll Be Doing: Design, build and optimise detections across both Microsoft Sentinel and Elastic Stack Develop and maintain advanced detection content using KQL and EQL Lead end-to-end threat modelling exercises across Azure, AWS , applications, identities, APIs and cloud-native services Identify attack paths, control gaps and detection opportunities using frameworks such as MITRE ATT&CK Engineer and automate investigation and response workflows using tools such as Tracecat, Tines, Shuffle or similar SOAR platforms Build automated playbooks covering triage, containment, enrichment, escalation and response activities Conduct proactive threat hunting across cloud, endpoint, identity and application telemetry Collaborate with internal stakeholders and external SOC partners to continuously improve detection coverage Tune and refine alerting to improve signal quality and reduce false positives Create and maintain detection engineering documentation, response procedures and operational runbooks Drive measurable improvements in detection coverage against key attack techniques targeting cloud environments What We're Looking For: Previous experience as a SOC Analyst, Senior SOC Analyst, Threat Hunter or Detection Engineer 5+ years' experience within Cyber Security Operations, Detection Engineering or Threat Detection Strong hands-on experience with both: Microsoft Sentinel Elastic Stack (Elasticsearch, Kibana, Elastic Security) Demonstrable expertise writing and tuning detection content using: KQL (Kusto Query Language) EQL (Event Query Language) Proven experience delivering threat modelling across enterprise cloud platforms Deep understanding of attacker techniques, detection strategies and defensive security controls Strong knowledge of AWS security services including CloudTrail, GuardDuty, Security Hub and VPC Flow Logs Strong knowledge of Azure security monitoring and logging capabilities Experience building security automation and orchestration workflows using: Tracecat Tines Shuffle Or equivalent SOAR platforms Experience creating automated incident response playbooks from initial alert through containment and remediation Strong understanding of the MITRE ATT&CK framework and cloud attack techniques Excellent stakeholder management and communication skills Desirable: Python or PowerShell scripting experience Experience working with MDR, MSSP or external SOC providers Knowledge of detection-as-code methodologies Relevant certifications such as CISSP, GCIH, GCFA, GIAC, Azure Security Engineer or AWS Security Specialty Technical Environment: Keywords: Detection Engineering, Threat Detection, SOC, Sentinel, Elastic Stack, KQL, EQL, Threat Modelling, Azure Security, AWS Security, Incident Response, SOAR, Tines, Tracecat, Threat Hunting, MITRE ATT&CK. ? 6 Month Fixed-Term Contract ? £110k-£120k pro rata ? 100% remote Apply Smart Sourcer Limited Other Sectors and Industries 2 Jobs Similar Lead Cloud Detection & Threat Modelling Engineer Jobs Popular with Other Job Seekers SIEM Engineering Specialist Randstad Digital Birmingham (B1), B1 £550 - £560 per annum 23 hours ago NEW Senior Oracle Cloud Technical Consultant Hackajob Ltd St James, South West London (SW1) Competitive 1 day ago Senior Cloud & AI Security Enablement Engineer Hackajob Ltd Clerkenwell, City of London (EC1) Competitive 1 day ago Solutions Architect - Oracle HCM Sanderson Recruitment Bristol (BS1) £800 - £850 per day 21 hours ago NEW Detection Engineer Sanderson Government and Defence London Negotiable 1 week ago Security Platform Engineer, UK Security Operations Hackajob Ltd St James, South West London (SW1) Competitive 1 day ago Integration Architect Hackajob Ltd St James, South West London (SW1) Competitive 1 day ago Senior Platform Engineer Anson Mccade Manchester (M11) From £55,000 to £65,000 per annum 1 day ago Systems Integration Engineer Hackajob Ltd Warton, Carnforth (LA5) Up to £49k per year 1 day ago Senior Solution Architect – Microsoft Dynamics 365 Bilge Adam Technologies UK Ltd London From £70,000 to £90,000 per annum 2 weeks ago Lead Cloud Detection & Threat Modelling Engineer jobs Lead Cloud Detection & Threat Modelling Engineer jobs in City Of London IT jobs IT jobs in City Of London Infrastructure jobs Infrastructure jobs in City Of London Jobs in City Of London Full Time jobs Weekend jobs Retail jobs Amazon Warehouse Operative jobs Christmas jobs Night Shift jobs NHS jobs Apprenticeship jobs Warehouse jobs Cleaning jobs No Experience jobs Remote jobs Admin jobs Administration jobs Apprenticeships jobs Tesco jobs Get hired. Find success. Get started Totaljobs About us Careers at Totaljobs Press Partners Privacy policy Terms and conditions Cookies Legal and compliance Accessibility Jobseekers Salary Planner Jobseeker help centre Career advice Recruiters Post job ads Recruiting news Courses Contact us - recruiters Recruit internationally Download App store Play store The Stepstone Group UK Ltd © 2026 We use cookies We use cookies to operate our website, measure how people use our services to help us improve them, enrich usage profiles and personalise the content displayed to you. We also share information about your use of our site with our social media, advertising, and analytics partners, who may combine it with other information, to show you relevant ads on other websites, and to measure the performance of our advertising. Some cookies are essential for the operation of our website. If you would prefer us not to use the non-essential cookies, click “Just necessary”, but please be aware that this may impact your experience of our site and the services we are able to offer. Click “Accept” if you’re happy for us to place these cookies. You can change your mind at any time. Store and / or access information on a device Cookies, device identifiers, or other information can be stored or accessed on your device for the purposes presented to you. Personalised ads and content, ad and content measurement, audience insights and product development Ads and content can be personalised based on a profile. More data can be added to better personalise ads and content. The performance of ads and content can be measured. Insights about audiences who have viewed the ads and content can be extracted. Data can be used to build or improve user experience, systems and software. Display third-party content (social networks, videos) Content from social networks and embedded content from third-party providers can be displayed. Identifiers derived from authentications If an identifier is created based on authentication data, such as contact details associated with online accounts you have set up on websites or apps (e.g. email address, phone number) or customer identifiers (e.g. an identifier provided by your telecommunications provider), then this identifier can be used to recognize you across websites, apps and devices if you are logged in with the same contact details. Just Necessary Accept All Cookie Settings You can also exercise your right to object to data processing based on legitimate interests under “Privacy Policy”. Privacy Policy Cookie policy