Ofertas › Sanderson Government and Defence
Sanderson Government and Defence · South East London, United Kingdom · £48,000 - 88,000 per year
Salary: £48,000 - 88,000 per year Requirements: Active SC clearance 1–3 years experience in a SOC Analyst, Security Analyst, Detection Engineer, or Security Operations role Strong hands-on experience with Splunk and SPL query development Experience building, tuning, and maintaining SIEM detection rules AWS security monitoring experience, including CloudTrail, GuardDuty, IAM, and VPC Flow Logs Understanding of cyberattack techniques and threat detection methodologies Knowledge of incident triage, investigation, and escalation processes Experience with Windows, Linux, authentication systems, and endpoint security logs Strong communication and stakeholder engagement skills Desirable: experience with Cribl; knowledge of OCSF schemas and security data normalisation; familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks; experience with Sigma, YARA, or IDS signature development; exposure to Splunk SOAR, Cortex XSOAR, or other automation platforms; scripting experience in Python, PowerShell, or Bash; experience in UK Government or public sector environments; and Azure or Google Cloud Platform exposure. Responsibilities: Develop, test, and optimise Splunk SPL correlation searches and alerting logic Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures Build AWS-focused detections using CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs Tune and enhance detection content to improve alert accuracy and reduce false positives Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate Map detection coverage against the MITRE ATT&CK framework Monitor and triage security alerts in Splunk SIEM Investigate incidents, including phishing attacks, credential abuse, malicious process activity, and suspicious network traffic Support incident response through containment and escalation procedures Maintain detailed security case documentation and investigation notes Contribute to operational metrics, including MTTD and MTTR targets Technologies: AWS Azure Bash Cloud Flow IAM Support Linux Network PowerShell Python Security Splunk Windows DevOps More: We are a leading consultancy recruiting a Detection Engineer for a high-profile cybersecurity programme supporting critical public sector services. The role combines detection engineering and SOC operations, helping protect large-scale cloud environments and strengthen security monitoring across AWS and Splunk. You will work with SOC analysts, en